skills.rest
defconxt
defconxtCOMMUNITY
Explore all skills by this author →
GitHub

Blue Team / Defensive Security

Guide blue team operations with Sigma rules, log analysis, and security tool deployment.

Updated Aug 23, 2026
Search Tags:#log analysis#incident response#threat hunting#blue team#security hardening#detection engineering#defensive security
One-click install
npx skills add https://github.com/defconxt/CIPHER --skill blue-team-defensive-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Blue Team / Defensive Security
Source: https://github.com/defconxt/CIPHER/tree/main/skills/blue-team
Command: npx skills add https://github.com/defconxt/CIPHER --skill blue-team-defensive-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill empowers security professionals to build robust defenses, detect sophisticated threats, and respond effectively to security incidents by providing expert guidance on defensive security practices.

Core Features & Use Cases

  • Detection Engineering: Write and translate Sigma rules for various SIEMs.
  • Log Analysis & Correlation: Understand critical event IDs and log sources for threat hunting.
  • Threat Hunting: Develop and execute hypothesis-driven hunts.
  • Endpoint & Network Security: Harden systems, monitor network traffic, and deploy security tools like CrowdSec and Suricata.
  • Vulnerability Management: Prioritize patching based on exploitability and impact.
  • Identity Security: Implement zero-trust principles and secure privileged access.
  • Security Architecture: Apply CIS benchmarks and hardening best practices.

Quick Start

Use the blue team skill to write a Sigma rule for detecting suspicious net user enumeration.

Frequently Asked Questions about Blue Team / Defensive Security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Sigma rules for threat detection in different SIEMs?▼

Sigma rules for threat detection can be written and translated for various SIEMs to standardize detection engineering. This provides actionable commands to create rules that identify suspicious activities like net user enumeration across diverse log sources.

How do I prioritize vulnerability management and system hardening using CIS benchmarks?▼

Vulnerability management prioritizes patching by evaluating exploitability and impact, while system hardening applies CIS benchmarks. This establishes security architecture principles to secure endpoints, networks, and privileged access.

What is the best way to deploy network security tools like Suricata and Zeek for incident response?▼

Deploying network security tools like Suricata, Zeek, and CrowdSec monitors traffic and detects threats for incident response. This provides actionable commands to harden systems, correlate logs, and respond to security incidents effectively.

Can I implement zero-trust principles and identity security for privileged access?▼

Identity security implements zero-trust principles to secure privileged access and prevent unauthorized lateral movement. This provides expert guidance on defensive security practices to restrict access and verify user identities continuously.

Related Skills

Explore More Software Engineering Skills→
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced
pauljbernardpauljbernard
5

Threat Intelligence Director Excellence

Coordinate cyber threat analysis, intelligence collection, and incident response.

Community
Advanced
brucesongsbrucesongs
60

threat-hunting

Convert hunt hypotheses into Sigma-based detections with MITRE ATT&CK mappings.

Community
Advanced
gaashergaasher
150

purple-team

Orchestrate red-team attacks and blue-team patches for security guardrails and APIs.

Community
Advanced