Blue Team Investigation Skills
Solution overview
Your SOC has 6 data sources. Your analysts check them one at a time. What if your AI analyst could check all 6 in a single question?
In this lab, you build the defensive layer — 4 Blue Team skills that wire your AI analyst to Windows endpoints, Active Directory, Wazuh XDR, and Security Onion. Real event logs. Real alerts. Real network traffic flowing through your lab right now.
But the skills are just the wiring. The real lesson is what happens after you build them. You'll ask the same question two ways — once casually, once with structure — and watch the AI go from listing data to detecting automation patterns, flagging privilege risks, and categorizing traffic by intent.
By the end, you'll have 7 of 9 skills built. And you'll start to realize that the investigation quality isn't limited by your tools — it's limited by your questions.