Comprehensive intermediate roadmap to master blue team roles: defending, detecting, and responding to cybersecurity threats in organizations.
Intermediate
120h
cybersecurity
blue-team
incident-response
threat-detection
Card legend
Topic
Milestone
Task
Note
Decision
Project
Grouped
- AI Assist
- Progress
Sign in to use AI Assist
Sign In
Proof of Competence
0%
0 / 25 checkpoints declared
0/13 evidence needed for 100% — max 50% without proof
Blue Team Foundations
You can describe core cybersecurity concepts and explain the role of a blue team in protecting systems
Milestone
Outline the concepts of confidentiality, integrity, and availability in a short essay (clear explanation)
Checkpoint
You can explain SOC operations and participate in basic incident response exercises
Milestone
Complete a simulated SOC triage task (identify suspicious activity and escalate appropriately)
Checkpoint
Simulate SOC shift work including daily monitoring of log events and incident documentation
Project
Threat Detection and Monitoring
You can configure and interpret alerts from IDS/IPS systems and perform basic network traffic analysis
Milestone
Set up an open-source IDS tool and analyze sample alerts (correctly classify true positives vs false positives)
Checkpoint
You can deploy and operate EDR tools and identify suspicious endpoint behaviors for triage
Milestone
Install an EDR agent on a test machine and simulate detection of common threats (document findings)
Checkpoint
Create an incident response playbook for endpoint compromises using simulated malware infection scenarios
Project
Incident Response & Forensics
You can design an incident response plan and lead communication during a mock incident
Milestone
Draft an IR plan for a hypothetical medium-size enterprise including escalation paths (clear plan document)
Checkpoint
You can perform basic forensic acquisition and analysis to support incident investigations
Milestone
Conduct a forensic analysis on a provided disk image and generate a report (identify key artifacts)
Checkpoint
Execute a capture-the-flag forensic challenge involving file and memory analysis
Project
Defensive Architecture and Hardening
You can design and implement secure network segments and deploy deception tools to detect adversaries
Milestone
Configure firewall rules according to least-privilege principles in a lab environment (confirm traffic restrictions)
Checkpoint
You can implement system hardening baselines and ensure security compliance for critical assets
Milestone
Apply security hardening guidelines on a target operating system and verify settings (pass vulnerability scans)
Checkpoint
Create and enforce a patch management schedule and process for an enterprise application deployment
Project
Security Tooling and Automation
You can deploy and tune a SIEM system to provide actionable security alerts and reports
Milestone
Build SIEM rules that detect common attack patterns in test log data (alerts match known threats)
Checkpoint
You can automate repetitive security operations and integrate tools for faster incident mitigation
Milestone
Develop a SOAR playbook that automates alert triage and initial containment actions (test with simulated incidents)
Checkpoint
Build a small automation tool that pulls alerts from a SIEM and triggers containment steps in an EDR system
Project