The document discusses blue teams and the role of SOC analysts. It defines a blue team as a company's cybersecurity employees housed in a SOC, made up of highly skilled analysts who work to defend and improve organizational defenses. Different roles in a blue team are outlined, including SOC analysts, threat hunting, threat intelligence, malware analysis, and digital forensics. The responsibilities of an entry-level SOC analyst are described, along with common SIEM tools and example event types monitored. Finally, it suggests ways for SOC analysts to learn and grow in their careers.

1. Blue Team
Sabyasachi Sahoo
SOC L1

2. Agenda
• What is blue team
• Why company Need blue team Member’s
• Basic of Soc
• Where to learn and Grow
20XX 2

3. 20XX 3

4. Introduction
Presentation title
A blue team is a company's
own cybersecurity employees,
which is usually housed in a
Security Operations Centre
(SOC). The SOC is made up of
highly skilled analysts who
work around the clock to
defend and improve their
organization's defenses.
20XX 4

5. All Blue Teams are
defenders, but not all
defenders are part of a Blue
Team.

6. The blue team's methods include:
Presentation title 20XX 6

7. DAMAGES VS ATTACKER’S

8. Different Teams in Blue Team IN MNC
SOC Analyst[L1,L2,L3]
Threat Hunting
Threat inteiligence
Malware Analyst
 OSINT Investigator
DFIR

9. SOC OVERVIEW
• Level 1 SOC Analyst is an operational role, focusing on real time
security event monitoring and security incident investigation. As a
Level 1 SOC Analyst you will actively monitor security threats and risks
involving customers’ infrastructure. More specifically, the key
responsibilities are the following:
• continuously monitors the security alerts queue
• triages security alerts
• monitors health of customer security sensors and SIEM infrastructure
• collects data and context necessary to initiate Level 2 escalation
• delivers scheduled and ad-hoc reports
• works closely with Level 2 & Level 3 team towards the continuous
improvement of the service
• Job Schedule: 24x7 shift environment

10. SOC analyst career path

11. SEIM TOOLS
• SIEM stands for Security Information and Event Management.
SIEM tools provide real-time analysis of security alerts
generated by applications and network hardware.
LogRhythm NextGen SIEM
• MIcro Focus ArcSight ESM
Solar Winds Threat Monitor
Splunk Enterprise Security
IBM QRadar
Elk

12. EVENT TYPE
• 4624=Successful Logon
• 4625=logon Failed
• 4672=Special privileges assigned to
new logon
• 4771= Kerberos pre-
authentication failed.
• 4726= A user account was
deleted.
• 4956= Windows Firewall has
changed the active profile.

13. How to check reputation of any Ip and URL

16. Where to learn and grow