Implementing a Kick-Butt Training Program: BLUE TEAM GO!
summary
A practical five-week framework that trains analysts to do, not just memorize, with each week mapped to concrete skills: week 1 onboarding and SIEM setup with Splunk and log retention limits, week 2 packet analysis with Wireshark and Zeek, week 3 host-based forensics including NTFS MFT and Eric Zimmerman tools, week 4 reverse engineering and sandbox pitfalls, week 5 threat hunting, IOC handling and ticket-driven exercises. Uses Volatility for memory, Moodle/Mnemosyne for reinforcement, and live labs to measure capability.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 2:27Why baseline training matters
- 5:15Core training principles
- 10:25Five-week training framework
- 15:02Networking and DNS fundamentals
- 19:54Host-based forensics deep dive
- 25:08Working tickets and intelligence
- 28:19Q&A and closing
related talks
49mTraining for Incident Response: The Red, the Blue, and the Ugly
34mPurple Team Strategies for Application Security
05mTowards a more effective system for training tier 1 SOC analysts
43mGuerrilla Warfare for the Blue Team
56mBuilding An Effective Application Penetration Testing Team
41mPurple Is the New Red - Providing the Most Value from Offensive Security
43mShades of Purple: Getting Started and Making Purple Teaming Possible
56mOn Building Teams