Blue Team Handbook: SOC, SIEM, and Threat Hunting (V1.02): A Condensed Guide for the Security Operations Team Don Murdoch

NOTE: As of 4/6/18, BTHb: SOCTH is rev'd to 1.02. This entry is for the first version!Blue Team Handbook: SOC, SIEM, and Threat Hunting Use Cases provides the security practitioner with numerous field notes on building a security operations team and mining data sources to get the maximum amount of information out of them with a threat hunting approach. The author shares his fifteen years of experience with SIEMs and security operations after implementing five major platforms, integrating over one hundred data sources into various platforms, and running a MSSP practice.This book covers the topics below using a "zero fluff" approach as if you hired him as a security consultant and were sitting across the table with him (or her). Topics covered include: -The book begins with a discussion for professionals to help them build a successful business case and a project plan, and deciding on SOC tier models. There is also a list of tough questions you need to consider when proposing a SOC, as well as a discussion of layered operating models. - It then goes through numerous data sources that feed a SOC and SIEM and provides specific guidance on how to use those data sources. Most of the examples presented were implemented in one organization or another. These uses cases explain how to use a SIEM and how to use the data coming into the platform, a question that is poorly answered by many vendors.-An inventory of Security Operations Center (SOC) Services.- Several business concepts are also introduced, because they are often overlooked by IT: value chain, PESTL, and SWOT. - Metrics, with a focus on objective measurements.-SOC staff onboarding, training topics, and desirable skills. Along these lines, there is a chapter on a day in the life of a SOC analyst. - Maturity analysis for the SOC and the log management program. - Applying a Threat Hunt mindset to the SOC. - A full use case template that was used within two major Fortune 500 companies, and is in active use by one major SIEM vendor, along with a complete example of how to build a SOC and SIEM focused use case. You can see the corresponding discussion on YouTube - search for the 2017 Security Onion conference. - Critical topics in deploying SIEM based on experience deploying five different technical platforms for nineteen different organizations in education, nonprofit, and commercial enterprises from 160 to 30,000 personnel. - Understanding why SIEM deployments fail with actionable compensators. - Real life experiences getting data into SIEM platforms and the considerations for the many different ways to provide data. - Issues relating to time, time management, and time zones. - Critical factors in log management, network security monitoring, continuous monitoring, and security architecture related directly to SOC and SIEM.- A table of useful TCP and UDP port numbers. This is the second book in the Blue Team Handbook Series. Volume One, focused on incident response, has over 32,000 copies in print and has a 4.6/5.0 review rating!Version 1.0.1 - Updated Dec 12, 2018: Minor spelling and grammar updates.