---
title: "Blue Team"
canonical: "https://codeandcypher.com/tags/blue-team/"
---

# Blue Team



## Index

- [Acuity Health: Part 5 — Active Defense & Canary Deception](/series/acuity-health-security-architecture/part-5-active-defense-threat-hunting-canaries/index.md) (2026-10-06): Engineer active deception environments, plant canary tokens in memory and file shares, and automate blue team threat hunting across enterprise network shares.

- [Hands-On AI Security: Blue Teaming and Building the Security Gateway](/series/hands-on-ai-security/part-3-blue-teaming-building-the-security-gateway/index.md) (2026-09-24): Construct an external security gateway in Flask to inspect incoming prompts, enforce guardrails, and intercept leaked secrets before they reach the browser.

- [Triage Under Fire: The Lean Team's 48-Hour Hardening Blueprint for September 2026 Patch Tuesday](/posts/the-lean-teams-48-hour-patch-tuesday-blueprint/index.md) (2026-09-09): How lean security teams triage Patch Tuesday, filter the firehose, harden Kerberos identity boundaries, and contain critical flaws in the first 48 hours.

- [Active Blue-Team Defense, Applied Cryptography & Security Operations](/papers/active-defense-cryptography-and-blue-team-integration/index.md) (2026-07-13): Enterprise research synthesis on active blue-team defense, applied cryptography, and Zero Trust network telemetry operations in high-threat environments.

- [Supply Chain Cyber Attack Investigation: Root Cause Analysis, Impact Scoping, and Remediation](/papers/csol570-final-assignment-7-1-supply-chain-attack-investigati/index.md) (2025-10-18): Forensic root cause analysis and scoping of a decentralized software supply chain compromise, establishing containment and vendor remediation.

- [Post-Exploitation Detection and Network Reconnaissance Signature Analysis](/papers/csol570-post-exploitation-and-nmap-scanning/index.md) (2025-09-29): Technical analysis of network reconnaissance signatures and post-exploitation detection using telemetry from host and network sensors.

- [Open Source Intelligence (OSINT) and Mobile Telemetry for Blue Team Defense](/papers/csol570-open-source-and-mobile-intel-for-security/index.md) (2025-09-20): Open-source intelligence (OSINT) and mobile telemetry collection framework for proactive threat hunting and attack surface monitoring.

- [Honeypots and Deception Technologies: Strategic Attacker Disruption and Early Warning](/papers/csol570-honeypots-and-deception-techniques/index.md) (2025-09-14): Strategic evaluation of honeypots, honeytokens, and active deception technology to disrupt attacker reconnaissance and generate high-fidelity alerts.

- [The Blue Team Mindset: Active Defense, Telemetry Engineering, and Defensive Posture](/papers/csol570-the-blue-team-mindset/index.md) (2025-08-01): Exploration of active blue-team defense methodologies, telemetry engineering, and continuous adversary engagement in enterprise SOCs.