دانلود کتابچه راهنمای تیم آبی: مرکز عملیات امنیت (SOC)، SIEM و شکار تهدید

Blue Team Handbook: SOC, SIEM, and Threat Hunting teaches you how to build out security operations teams and centers as if you were sitting over coffee with a twenty-year veteran in the field. This book was written for the express purpose of providing practical day-to-day guidance for Security Operations, implementing SIEM, and using SIEM and other data sources for modern threat hunting. This book will cover many topics related to the Security Operations Team from a “Field Notes” perspective. It is based on a long career implementing multiple SIEM technologies, building SOC’s, conducting all manner of cyber investigation, developing and running an MSSP, and working as the Countermeasures lead with one of the largest Splunk installations in the USA. The major topics are: Building a Security Operations functional unit, including provisioning plan, budget considerations, thought habits, analyst skills, and tiering structures. Deciding how to structure your Security Operations capability and the services it will offer. An extensive discussion of security focused use cases organized by their respective data source. This chapter describes what to monitor from a given data source, as succinctly as possible. Many of these use cases have a threat hunting theme to them. Building Security Operations Use Cases using my own Use Case Template, followed by a complete use case to use as a model in your own work, and some excerpts from other use cases. Critical SOC analyst skills and investigation processes, which my own team used while I managed a MSSP operational unit for two years in a mid-sized consulting firm. A discussion on applying modern Threat Hunting to the Security Operations team. And a host of other topics that relate to security operations, SOC analyst skills, and SIEM.
It is my sincere hope that this book delivers on the Blue Team Handbook motto: “a zero-fluff reference guide for the security practitioner, written with the intention of sharing real life experience”. I trust that you will learn something useful as you read it as many readers of Blue Team Handbook: Incident Response (BTHb:INRE) have shared with me over the years.