You're reading from Purple Team Strategies Enhancing global security posture through uniting red and blue teams with adversary emulation

Product type Paperback

Published in Jun 2022

Publisher Packt

ISBN-13 9781801074292

Length 450 pages

Edition 1st Edition

Tools

Kali Linux

Concepts

Penetration Testing

Authors (4):

David Routin

Samuel Rossier

Simon Thoores

Michael Molho

View More author details

Table of Contents (20) Chapters

Preface

1. Part 1: Concept, Model, and Methodology

2. Chapter 1: Contextualizing Threats and Today's Challenges FREE CHAPTER

3. Chapter 2: Purple Teaming – a Generic Approach and a New Model

4. Chapter 3: Carrying out Adversary Emulation with CTI

5. Chapter 4: Threat Management – Detecting, Hunting, and Preventing

6. Part 2: Building a Purple Infrastructure

7. Chapter 5: Red Team Infrastructure

8. Chapter 6: Blue Team – Collect

9. Chapter 7: Blue Team – Detect

10. Chapter 8: Blue Team – Correlate

11. Chapter 9: Purple Team Infrastructure

12. Part 3: The Most Common Tactics, Techniques, and Procedures (TTPs) and Defenses

13. Chapter 10: Purple Teaming the ATT&CK Tactics

14. Part 4: Assessing and Improving

15. Chapter 11: Purple Teaming with BAS and Adversary Emulation

16. Chapter 12: PTX – Purple Teaming eXtended

17. Chapter 13: PTX – Automation and DevOps Approach

18. Chapter 14: Exercise Wrap-Up and KPIs

19. Other Books You May Enjoy

Chapter 8: Blue Team – Correlate

This chapter is the last one regarding blue team infrastructure. In this chapter, we will discuss security information and event management (SIEM). We will try to understand the philosophy of different SIEM solutions, their pros and cons, and how they can help us in our blue and purple teaming activities.

The second part of this chapter will demonstrate how to leverage Splunk's Search Processing Language (SPL) with specific functions we may not be aware of that help us perform any kind of advanced detections, such as recurring frequency, dynamic comma-separated values (CSV) push/pull, and alerts based on the Least Frequency of Occurrence (LFO). Finally, we will introduce the Kusto Query Language (KQL) used in Microsoft Defender for Endpoint (formerly known as Defender ATP) for hunting, and show practical queries useful for any investigations that could also be implemented to create specific detection rules.

We'll cover the following...

The rest of the chapter is locked

You're reading from Purple Team Strategies Enhancing global security posture through uniting red and blue teams with adversary emulation

Table of Contents (20) Chapters

Chapter 8: Blue Team – Correlate

Unlock this book and the full library FREE for 7 days

Authors (4)

Personalised recommendations for you