Blue Team: SOC & Defensive Security

Defenders work backwards from evidence. This path puts you in the responder's seat: given logs, a captured network trace, and a host that was pulled offline after suspicious activity, you reconstruct what the attacker did and recover what they tried to hide. You practise the day-to-day skills of a Security Operations Centre — log triage, timeline building, and spotting persistence.

Analysts and aspiring defenders who want hands-on incident-response practice: reading logs, following an intrusion through the artefacts it leaves, and understanding attacker techniques from the defender's side.

Comfort on a Linux shell (cat, grep, less) and reading common log formats. A little base64/XOR decoding helps. The Pre-Security path is a good warm-up.