Blue Team Handbook: SOC, SIEM, and Threat Hunting. Practical Techniques for Security Operations and Threat Hunting Teams Don Murdoch

(ebook) (audiobook) (audiobook)

Nowość
Promocja Przejdź

Blue Team Handbook: SOC, SIEM, and Threat Hunting. Practical Techniques for Security Operations and Threat Hunting Teams Don Murdoch - okladka książki

Blue Team Handbook: SOC, SIEM, and Threat Hunting. Practical Techniques for Security Operations and Threat Hunting Teams Don Murdoch - audiobook MP3

Blue Team Handbook: SOC, SIEM, and Threat Hunting. Practical Techniques for Security Operations and Threat Hunting Teams Don Murdoch - audiobook CD

Autor:: Don Murdoch
Wydawnictwo:: O'Reilly Media (Z chęcią przeczytam książkę w języku polskim)
Ocena:: Bądź pierwszym, który oceni tę książkę
Stron:: 490
Dostępne formaty:: ePub

Mobi

Ebook

228,65 zł ~~269,00 zł~~ (-15%)

220,15 zł najniższa cena z 30 dni

Dodaj do koszyka Dostępny natychmiast po opłaceniu zakupu lub Kup na prezent Kup 1-kliknięciem

Przenieś na półkę

Do przechowalni

As cyberthreats become more sophisticated and alert volumes rise, security teams need more than just tools—they need strategy, structure, and field-tested guidance. Following the success of the original edition, this updated edition of Blue Team Handbook: SOC, SIEM, and Threat Hunting is still the essential resource for building, optimizing, and managing modern detection engineering practices and security operations centers.

This practical guide distills over 20 years of frontline cybersecurity experience into an actionable playbook for analysts, SOC managers, architects, detection engineers, and threat hunters. Author Don Murdoch delivers expert insights designed to help teams improve quickly. Whether you're refining your current operations or launching a SOC from scratch, this book empowers you with proven, real-world techniques to defend against today's most persistent threats.

Build and organize SOC teams for maximum operational impact
Understand how to launch and execute a comprehensive telemetry, audit data, and SIEM deployment strategy
Create effective SOC use cases
Develop and apply meaningful metrics to evaluate SOC effectiveness, analyst performance, and SIEM utility
Identify advanced threats using real-world threat hunting techniques

Wybrane bestsellery

Promocja

As cyberthreats grow and infrastructure evolves, organizations must prioritize effective, dynamic, and adaptable incident response. Following the success of the original edition, Blue Team Handbook: Incident Response has been updated to reflect today's evolving cybersecurity landscape. This trusted and widely used field guide for cybersecurity inci
- ebook
Blue Team Handbook: Incident Response

Don Murdoch

(186,15 zł najniższa cena z 30 dni)

29.90 zł ~~228.99 zł (-87%)~~

Ebooka "Blue Team Handbook: SOC, SIEM, and Threat Hunting. Practical Techniques for Security Operations and Threat Hunting Teams" przeczytasz na:

czytnikach Inkbook, Kindle, Pocketbook, Onyx Booxs i innych
systemach Windows, MacOS i innych

systemach Windows, Android, iOS, HarmonyOS
na dowolnych urządzeniach i aplikacjach obsługujących formaty: PDF, EPub, Mobi

Masz pytania? Zajrzyj do zakładki Pomoc »

Oceny i opinie klientów: Blue Team Handbook: SOC, SIEM, and Threat Hunting. Practical Techniques for Security Operations and Threat Hunting Teams Don Murdoch

(0)

Szczegóły książki

ISBN Ebooka:: 979-83-416-6231-5, 9798341662315
Data wydania ebooka :: 2026-09-09 Data wydania ebooka często jest dniem wprowadzenia tytułu do sprzedaży i może nie być równoznaczna z datą wydania książki papierowej. Dodatkowe informacje możesz znaleźć w darmowym fragmencie. Jeśli masz wątpliwości skontaktuj się z nami sklep@helion.pl.
Język publikacji:: angielski
Rozmiar pliku ePub:: 10.5MB
Rozmiar pliku Mobi:: 35.6MB

Zgłoś erratę

Spis treści książki

Foreword
Preface
- Who Should Read This Book
- Why I Wrote This Book
- Navigating the Book
- Conventions Used in This Book
- Using Code Examples
- OReilly Online Learning
- How to Contact Us
- Acknowledgments
I. Security Operations Field Notes
1. Security Operations Center Field Notes
- Start with a SOC Charter
- Be Prepared for Tough Questions
- Identify SOC Services by Development Phase
  - The Security Operations SIPOC Diagram
  - The Voice of the Customer
  - Security Monitoring
  - Incident Response Initiation and Management
  - Incident Response and IR Command Management
  - Vulnerability Management
  - Forensics/eDiscovery
  - Reporting
  - Malware Analysis
  - Intrusion Detection
  - Alert Notification Refinement and Improvement
  - Network Security Monitoring
  - Threat Hunting
  - Platform Health Monitoring
  - Cyber Threat Intelligence
  - Threat Intelligence Feed Integration
  - Policy and Procedure Support
  - Internal Training
- SOC Project Planning Outline
  - SOC Business Case
  - Business Case, Charter, and Project Plan
  - Business Case Outline
  - Environmental Data Inventory Survey (EDIS) and Planning
    - Project management and EDIS steps
    - SIEM technology provisioning
    - Use cases
    - Response processes
    - Continuous training program
  - Collect Essential Data Sources Using Your Data Onboarding Plan
  - Useful MBA Concepts: Value Chain, SWOT, and PESTL
    - The value chain tie-in
    - SWOT analysis
    - PESTL analysis
- Funding the SOC
  - Understand the App Stack
  - Finalize the Reasons to Fund SecOps
  - Identify Security Operations Center Cost Components
    - Staff cost considerations
    - Facility and space
    - Vendor-neutral formal education
    - Product training
    - Organization-specific training
    - Desktop support
    - Vendor support
    - Infrastructure
    - Integration of new data sources
    - Content development
    - SIEM software
    - SIEM software upgrades
    - Audit evidence support
  - In-House Versus Outsourced Versus Hybrid SOC
- Getting into the Hunt
- CSIRT Function Support
- IT General Controls Policy and Procedures That Support the SOC
  - Security Policies That Support the SoC
  - Security and IT Procedures That Support the SOC
  - Examples of Security Incidents Due to Lack of Policies or Procedures
- Generative AI, Agentic AI, and LLMs
  - Large Language Models
  - Generative AI and LLMs in Current SOC Operations
    - Natural language interfaces to security tooling
    - Threat intelligence synthesis and contextualization
  - The Agentic SOC: Autonomous Operations at Machine Speed
    - Agentic security operations architecture
    - IBMs Autonomous Threat Operations Machine
    - Human-in-the-loop: The principle of appropriate autonomy
  - Measured Operational Impact
- Useful References and Standards
  - Industry Reports and Organizations of Note
  - MITRE ATT&CK
  - InfoSec Standards
2. SOC Access, Training, Skills, Staffing, and Roles
- SOC Access
- SOC Onboarding and Initial Training
- SOC Analyst Skills
- SOC Analyst Traits
- SOC Roles
- SOC Layered Operating Models
  - Two-Layer Model
  - Three-Layer Model
- SOC Maturity Curve Using the CMMI
  - Measuring Data Source Integration Maturity Levels
  - Measuring Alarm Processing Management Maturity Levels
- Example SOC Turnover Shift Checklist
3. Metrics for the SOC
- Risks and Trade-offs for SOC Metrics
- The SOC Balanced Scorecard
4. Threat Hunting Practices in the SOC
- Threat Hunting Program Outline
  - Foundation
  - Data and Telemetry
  - Threat Hunting Intake
    - Sources of hunting inspiration: Commercial and vendor threat intelligence
    - Government and ISAC sources
    - Open source and community intelligence
    - Dark web and underground monitoring
    - Internal and contextual sources
    - From intake to hypothesis
  - Hypothesis-Driven Hunt Loop
- Example Threat Hunts
  - Normal User Activity
  - Perimeter Firewall Denies
  - System Stability
  - Outbound Threat Intelligent Contacts
  - Anomalous Device Communications
  - Anomalous MFA Authentications
  - Web Proxy Block Traffic
  - Threat Hunt Example
- Leverage the MITRE ATT&CK Framework
- Retro Hunting: Hunting Historical Data Based on Current Intel and Alarms
  - Hunting Based on Malware Campaigns
  - Excessive, or Multiple, Source IPs for User Logins
  - Web (HTTP) Transactions in Volume per Day
  - Command-and-Control Detection
  - Lateral Movement or Lateral Traversal
  - Pass the Hash
  - Other Windows System Traces
  - Network Traces
- Using the Lockheed Martin Cyber Kill Chain
- IoAs, IoCs, and Data Dependencies
- Example SOC-Focused Threat Hunt Checklist
- SANS Hunting Maturity Model
- Further Reading
5. A Day in the Life of a SOC Analyst
- Alarm Triage Overview
- Dashboard or Summary Data Review Techniques
- Periodic Security State Data Review
- SOC/SIEM Support System Component Health Review
- Identify and Report IT Operational Issues
- Review of Security Intelligence Data
- Alarm Investigation Process
  - Techniques and Analysis Methods by Data Source
  - Improving Investigations Through Analyst Questions
  - Performing Well-Rounded Alarm Analysis
  - Skill Development Moment: Cognitive Bias Awareness
  - Skill Development Moment: Graph Theory Versus List Thinking
6. Timekeeping and Event Times
- Timekeeping Concepts and Definitions
  - Event Time
  - Device Time
  - Device Drift Time
  - SIEM Ingest Time
  - Alarm Time
  - Adjusted Event Offset
  - UTC
  - Time Zone
  - Epoch
  - Antiforensics
  - Timestomping
  - Filesystem and Application Resolution
- Daylight Saving Time
- Network Time Protocol
- NTP Device Configuration
  - DHCP OptionsWindows
  - DHCP OptionsLinux
  - Windows Domains (Windows Server 2016, 2019, 2022, and 2025)
  - Entra IDHybrid Environments (On-Premises AD Synced to Entra ID)
  - Hybrid-Joined Devices
  - Cloud-Only EntraID Joined Devices
- Analyst Time Checklist
7. Continuous Monitoring
- Getting CM Right
- Continuous Monitoring Checklist for SOC Services
  - Network Monitoring
  - Endpoint Monitoring
  - Identity and Access Monitoring
  - Cloud Security Monitoring
- Other Areas and Metrics for Continuous Monitoring
8. Security Architecture Considerations for SOCs
- Domain Ownership and Squatting Detection
- Perimeter Security
- Network Security Monitoring
  - Implement Logon Separation
  - Control Potential Data Exfiltration
- Internet Control Message Protocol
- Domain Name Services
- Server Management Isolation
- DHCP
- External IP Visibility
- Open Source Intelligence
II. Use Case Development
9. SOC and SIEM Use Cases and Template
- SIEM/SOC Use Case Development Process
- A Scenario
  - The Setup
  - The Attackers Plan to Find Data and Exfiltrate
  - The Defense Plan
- Defining the SOC Use Case
  - Example: Web Presence Attack
  - Example: End-User Payload-Focused Attack
- Organizational Considerations for Use-Case Development
- Top 10 Security Operations Use Cases
- Template Instructions
- Use Case Template
10. Complete SOC and SIEM Use Case Example
- Title: Monitoring Elevated Group and Role Membership
  - Problem Statement
  - Requirement Statement(s)
- Design Specifications and Discrete Objectives
- Security Operations Center Notification
  - Use Case Component Name(s)
  - Use Case Data Source Description
  - Use Case Data Stream Analysis
  - MITRE ATT&CK Mapping
  - Cyber Kill Chain Analysis and Support
- Assumptions and Limitations
11. Partial SOC Use Cases
- Partial Use Case: Windows Network User Presence
  - Employee Investigation and Desktop Presence (Overview)
  - Domain Controller
  - User System
- Partial Use Case: Logins from Multiple ASNs
- Partial Use Case: System Not Logging/Reporting
- Partial Use Case: External (VPN) and Internal (Desktop/Server) Access
- Partial Use Case: Stacked Events
  - Phase One
  - Phase Two
- Partial Use Case: Policy Violation Issues
III. Detection Engineering and Detection Library
12. Detection Engineering
- Start the DE Journey
- Detection Engineering SIPOC
- A Repeatable Detection Development Life Cycle
  - Phase 1: Threat Intelligence and Requirements Development
  - Phase 2: Data Source Identification
  - Phase 3: Detection Logic Development
  - Phase 4: Testing and Validation
  - Phase 5: Deployment
  - Phase 6: Monitoring and Tuning
- MITRE ATT&CK Integration
  - Maintain ATT&CK Navigator and Adversary Groups
  - Maintain ATT&CK Navigator Layers Showing Detection Coverage
  - Identify and Prioritize Coverage Gaps
- Technology Stack Considerations and Detection Engineering
  - The Sigma Universal Rule Format
- Quality Assurance
  - Peer Review Process
  - Testing Standards
- Documentation and Knowledge Management
  - Detection Documentation
  - Runbooks and Playbooks
  - Escalation Criteria
  - Remediation Guidance
  - Evidence Collection Requirements
- Maintaining Quality
  - Quarterly Detection Coverage Assessment
  - Collect False-Positive Feedback
13. Network InfrastructureFocused Detection Use Cases
- Command and Control
- DHCP and Data Link Layer Analysis
  - DHCP and Layer 2 Use Cases
- Domain Name Services
  - Collecting DNS Data
  - DNS Monitoring Use Cases and Detection Patterns
  - Encrypted Client Hello Traffic
- IP DarkNet Unused Network Monitoring
- Network Hardware Devices and Appliances
  - Network Hardware Detection Use Cases
- Perimeter SecurityFocused Access
  - Perimeter Traffic Use Cases and Detection Rules
    - IP network layer protocols
    - An example
    - Protocol detection with NIDS
    - Application layer service protocols
  - Perimeter Use Case Requirements
- Top One Million Site Checks and Enrichment
  - Leveraging Top 1M Domain Rankings for Analysis
  - Top One Million Use Cases
- Top 10 and Bottom Few IP Address Use Cases
  - Top 10 IP Address Use Cases
- Tor Overlay Networks and Client Software
  - Tor Network Use Cases
  - Tor Exit Nodes
  - Examples of Tor Access Software
14. Network SystemFocused Security Monitoring Detection Use Cases
- Next-Generation Layer 7 Firewalls
  - Layer 7 Use Cases
- Web Proxy and URL Activity
  - Web Proxy Use Cases
- Network Intrusion Detection and Prevention
  - NIDS/NIPS Use Cases
- Web Application Firewalls
  - Top WAF Detection Use Cases
- Email and Web: Look-alike Domains
  - dnstwist DomainEnabled Use Cases
15. Windows SystemFocused Security Monitoring Detection Use Cases
- Application Whitelisting
  - Application Whitelisting Use Cases
- Data Islands or System Snowflakes
- Data Leakage (USB Insertion)
- Endpoint Detection and Response
  - Endpoint Detection Use Cases
- Operating System Security, Change, and Stability
  - Operating System Stability Use Cases
- Printing
- Windows Account Life Cycle Events (ALCE)
  - Account Life Cycle Use Cases
  - Advanced Monitoring Rules and Alerts That May Require External Scripting
- Windows Group Life Cycle Events
- Group-Based Monitoring Alerts
- Special Group Changes
- Account Usage Events
  - Account Logon Use Cases
  - Account Lockout Use Cases
- Windows Advanced Firewall
- Windows Presence Indicators
- Windows Process Execution Patterns and IoCs
  - Ransomware Extensions and File Patterns
  - Office Applications
- Windows Process Monitoring with Sysmon and Event ID 4688
  - Sysmon as a Preventive Control
  - Command Line for Long-Tail Analysis
  - Sysmon Event Table
  - ATT&CK Tactic and Technique Coverage with Sysmon
16. Enterprise Security Monitoring and Detection Use Cases
- Antispam and Email Messaging
- Antivirus Systems
- Data Loss Prevention
- Privileged Account Monitoring
- Monitoring Jump Boxes
  - Jump Box Use Cases
- Brute-Force Failed Authentication Attempts
  - Brute-Force Detection and Authentication Use Cases
- Web Server and Application Server Activity
  - Key Web and App Server Use Cases
IV. Log Management
17. Log Management
- Log Record Data Elements
- Account Management
- Logging System Components
- Log Filtering
- Log Times
- Log Retention, Audit, and Compliance Considerations
18. Manual Log Analysis for IR and the SOC
- Process Plaintext Data on Linux
- Process CSV Data
  - Analyzing NGFW CSV Data
- Reading Windows Security Event Logs
- Reading Sysmon with PowerShell
  - Event ID 1 for Command Lines
  - Event ID 3 for Network Connections
  - Event ID 22 for DNS Queries and Responses
- Exporting Event Data from Sysmon as JSON
  - Retrieving Command-Line Events
  - Retrieving Network Events
  - Retrieving DNS Query and Response
- Processing Sysmon JSON Data
  - DNS Queries and Suspicious TLDs
    - Network traffic
  - Command Line
  - Combined DNS, Network Connection, and Command Line
  - Other JSON Processing
V. Security Onion Example
19. Security Onion
- Sample Attack Flow
- Investigation
- Remediation
- Summary
- For More Information
Index