Blue Team

Understand it. Find it. Practise it.

Use Fundamentals for complete technical processes, Learn for structured reference, Observer for unified search, and the labs for system and query practice.

Nine focused workspaces

Choose the resource that fits the question.

The library, search and labs connect through useful links, but each keeps a clear purpose.

FundamentalsVisual technical foundations 5 journeys · 58 chapters Scenario LabPractical system journeys 24 scenarios OSI ModelThe seven layers, as an infographic 7 layers ObserverOne unified search LearnStructured security library 377 articles Tool HuntingEvidence-led field guides 1 field guide Case StudiesLayer-by-layer incident breakdowns 13 case studies KQL LabQuery practice 68 challenges Threat ActorsCyber threat intelligence dossiers 5 profiles

Cyber threat intelligence

Resolve the actor behind the signal.

Use source-resolved dossiers to compare vendor designations, campaign evidence, ATT&CK mappings, historical indicators and defensive priorities without flattening overlapping activity clusters into one alias list.

First profile BAUXITE

OT-focused activity with substantial technical overlap to the IRGC-affiliated CyberAv3ngers persona.

Browse Threat Actors