Chapter 4: Threat Management – Detecting, Hunting, and Preventing

Blue teams handle the defense security posture of the organization and will have to face threats targeting various scopes of their organization, from endpoints and perimetric devices to employees. Companies have introduced many types of security devices for the technical part, such as Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), and eXtended Detection and Response (XDR), for detection across multiple components.

Basically, in this chapter, we will extend the last part of the purple teaming process by diving deeper into the remediation step. Cyber threat management is a key process in order to reduce the risk identified as part of the purple teaming exercise.

We will describe the process to improve defenses and introduce the different types of controls we have at our disposal, how they work, and what frameworks and models exist out there to help us. We will tackle...