Blue Team Essentials¶
What this section is
The data a SOC analyst looks at every day (DNS, HTTP, email, endpoint logs, …), each explained as why it matters → what it is → what it actually looks like → when a SOC uses it. Anything that changed recently is marked [Changed], anything that is commonly stated wrongly or is risky if done the old way is marked [Caution] / [Correction], and practical must-knows are marked [Added].
Topics¶
-
DNS
DNS structure and record types, log collection and safe investigation, domain signals, unauthorised DNS, tunnelling, blockchain DNS, IDNs, encrypted DNS, and a suspicious-DNS triage sheet.
-
HTTP
Web servers and web shells, URL anatomy and phishing tricks, GET/POST and what gets logged, the other methods (CONNECT, HEAD, OPTIONS, PUT, DELETE, TRACE), reading request headers, judging real malicious requests (exploit kits, URLs inside URLs), response headers and status codes, new standards (HTTP/2, HTTP/3/QUIC, WebSocket), and practice questions with answers.
-
HTTP(S) Analysis & Attacks
Attack stages over HTTP, choosing automated vs manual analysis, URL reputation and OPSEC, with phishing checks, sandboxing, header and content analysis, file extraction and HTTPS analysis to follow.
Next topic
SMTP and email analysis (new section), followed by additional network protocols.
About these pages
Personal study notes. Not official guidance of any organisation.