Blue Team Capstone: Full Defense Scenario

The culmination of everything you have learned — bringing together monitoring, detection, response, forensics, and hardening into a single integrated defense operation, augmented by AI at every step.

Educational Use Disclaimer

Everything in this lesson assumes you are operating within a sanctioned environment — your own lab, an authorized engagement, or a CTF competition. Unauthorized use of these techniques against systems you do not own is illegal.

Course Recap: Lessons 1-9

Defense-in-Depth Architecture

No single control stops a determined attacker. Defense-in-depth layers multiple controls so that failure at one layer is caught by the next.

1. Perimeter — Firewalls, WAF, DDoS mitigation, DNS filtering
2. Network — IDS/IPS, network segmentation, traffic analysis, NetFlow monitoring
3. Endpoint — EDR, host firewalls, application whitelisting, OS hardening
4. Application — Input validation, authentication, authorization, secure coding
5. Data — Encryption at rest/in transit, DLP, access controls, backup verification
6. Human — Security awareness training, phishing simulations, access reviews
7. AI Layer — LLM-assisted anomaly correlation, automated triage, predictive analysis

Defense-in-Depth: Architecture Diagram

                    ┌──────────────────────────────────┐
                    │         AI CORRELATION           │
                    │   (LLM analysis across layers)   │
                    └────────────────┬─────────────────┘
                                     │
    ┌────────────┬──────────────┬────┴──────┬──────────────┬────────────┐
    │            │              │           │              │            │
┌───┴───┐  ┌────┴────┐  ┌─────┴─────┐ ┌───┴───┐  ┌──────┴──────┐ ┌───┴───┐
│Perim- │  │ Network │  │ Endpoint  │ │  App  │  │    Data     │ │ Human │
│eter   │  │         │  │           │ │       │  │             │ │       │
│-------│  │---------│  │-----------│ │-------│  │-------------│ │-------│
│FW/WAF │  │IDS/IPS  │  │EDR/AV     │ │AuthN  │  │Encryption   │ │Train  │
│DDoS   │  │Segm.    │  │Whitelist  │ │AuthZ  │  │DLP          │ │Phish  │
│DNS    │  │NetFlow   │  │Hardening  │ │Input  │  │Backups      │ │Review │
└───────┘  └─────────┘  └───────────┘ └───────┘  └─────────────┘ └───────┘

Each layer feeds telemetry into the centralized SIEM, where the AI correlation engine connects dots across layers in real time.

SOC Workflow with AI Augmentation

A modern Security Operations Center operates in a continuous loop. AI enhances each phase without replacing human judgment.

SOC Tier Model & AI Integration

The Full Defense Lifecycle

Every defense scenario follows this cycle. The capstone challenge will test your ability to execute each phase under pressure.

   MONITOR ──→ DETECT ──→ RESPOND ──→ FORENSICS ──→ HARDEN
      ↑                                                   │
      └────────────── CONTINUOUS IMPROVEMENT ──────────────┘

1. Monitor — Collect and aggregate telemetry from all layers
2. Detect — Identify anomalies and confirmed threats via rules + AI
3. Respond — Contain, eradicate, and recover from the threat
4. Forensics — Preserve evidence, analyze root cause, build timeline
5. Harden — Patch, reconfigure, add detection rules, update policies

Scenario Introduction: "Operation Shadow Breach"

Target Environment

• DMZ — Web servers (nginx), mail gateway, public DNS
• Internal — Active Directory domain, file servers, database cluster
• Cloud — AWS S3 buckets, Lambda functions, RDS instances
• Endpoints — 250 Windows workstations, 30 Linux servers

Phase 1: Monitoring — Baseline & Collection

Before you can detect anomalies, you need to know what "normal" looks like. Your monitoring stack must cover every layer.

Log Sources for the Scenario

# Monitoring stack configuration
log_sources:
  network:
    - zeek_conn_logs        # Connection metadata
    - suricata_alerts       # IDS signature matches
    - netflow_v9            # Traffic flow records
    - dns_query_logs        # DNS resolution tracking
  endpoint:
    - windows_security_log  # Event IDs 4624, 4625, 4688, etc.
    - sysmon_events         # Process creation, network, file
    - linux_auditd          # Syscall auditing
    - edr_telemetry         # CrowdStrike/Defender events
  application:
    - nginx_access_log      # Web request logs
    - nginx_error_log       # Server errors
    - auth_service_log      # Authentication events
    - database_audit_log    # SQL query auditing
  cloud:
    - aws_cloudtrail        # API call history
    - vpc_flow_logs         # Network flows in AWS
    - s3_access_logs        # Bucket access tracking

AI-Powered Baseline Monitoring

Use an LLM to analyze your baseline and flag deviations before traditional rules catch them.

import anthropic

def ai_baseline_analysis(current_metrics, baseline_stats):
    """Use AI to compare current metrics against established baselines."""
    client = anthropic.Anthropic()

    prompt = f"""Analyze these current network metrics against our baseline.
Flag anything anomalous and explain why it matters.

BASELINE (30-day average):
{baseline_stats}

CURRENT (last 15 minutes):
{current_metrics}

For each anomaly found, provide:
1. Metric name and current vs expected value
2. Deviation severity (low/medium/high/critical)
3. Possible benign explanation
4. Possible malicious explanation
5. Recommended investigation steps"""

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=2000,
        messages=[{"role": "user", "content": prompt}]
    )
    return response.content[0].text

Phase 2: Detection — The Attack Begins

02:47 UTC — Initial Alerts Fire

Five alerts in 3 minutes. A Tier 1 analyst might treat these as separate events. AI correlation reveals they are one attack with multiple fronts.

AI-Powered Alert Correlation

def correlate_alerts_with_ai(alerts):
    """Feed multiple alerts to AI for cross-layer correlation."""
    client = anthropic.Anthropic()

    alert_text = "\n".join([
        f"[{a['timestamp']}] {a['source']}: {a['description']} "
        f"(src={a['src_ip']}, dst={a['dst_ip']})"
        for a in alerts
    ])

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=3000,
        messages=[{"role": "user", "content": f"""You are a SOC analyst.
Correlate these alerts and determine if they represent:
A) Unrelated events  B) Related campaign  C) Active multi-stage attack

ALERTS:
{alert_text}

Provide:
1. Correlation assessment with confidence level
2. Attack chain hypothesis (MITRE ATT&CK mapping)
3. Predicted next attacker moves
4. Immediate containment recommendations
5. Evidence to preserve NOW before it is lost"""}]
    )
    return response.content[0].text

The AI identifies this as a coordinated attack: web exploitation + lateral movement + data staging + cloud pivot. Confidence: 94%.

MITRE ATT&CK Mapping of the Attack

Phase 3: Response — Containment

With the attack confirmed, containment must be swift and surgical. Contain too broadly and you disrupt business; too narrowly and the attacker pivots.

Immediate Containment Actions

1. Network isolation — Move compromised web server (10.0.1.50) to quarantine VLAN
2. Block attacker IPs — 198.51.100.47 and related C2 infrastructure at perimeter firewall
3. DNS sinkhole — Redirect exfiltration domain to internal sinkhole
4. Credential reset — Force password change for accounts on WS-042 and any AD accounts accessed
5. Cloud lockdown — Revoke compromised IAM role sessions, rotate access keys

# Emergency firewall block
sudo iptables -I INPUT -s 198.51.100.47 -j DROP
sudo iptables -I OUTPUT -d 198.51.100.47 -j DROP

# DNS sinkhole entry
echo "198.51.100.47 exfil-c2.evil.example" >> /etc/hosts

# AWS session revocation
aws iam put-role-policy --role-name CompromisedRole \
  --policy-name EmergencyDeny \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"DateLessThan":{"aws:TokenIssueTime":"2026-04-09T03:00:00Z"}}}]}'

AI-Assisted Incident Response Playbook

def generate_response_playbook(incident_summary, environment_context):
    """Generate a tailored IR playbook using AI."""
    client = anthropic.Anthropic()

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=4000,
        messages=[{"role": "user", "content": f"""As a senior incident responder,
generate a step-by-step playbook for this incident.

INCIDENT SUMMARY:
{incident_summary}

ENVIRONMENT:
{environment_context}

Include for EACH step:
- Action to take (specific commands where possible)
- Purpose / what this achieves
- Risk if skipped
- Verification check (how to confirm success)
- Estimated time to complete

Organize by priority: P0 (immediate), P1 (within 1 hour), P2 (within 4 hours)."""}]
    )
    return response.content[0].text

Phase 3 (cont.): Eradication

After containment stops the bleeding, eradication removes every trace of the attacker from the environment.

Eradication Checklist

• Malware removal — Identify and quarantine all dropped binaries, scripts, webshells
• Persistence removal — Delete scheduled tasks, registry run keys, cron jobs, startup items
• Backdoor account cleanup — Audit all accounts created or modified during the attack window
• Patch the vulnerability — Apply Apache Struts patch that enabled initial access
• Cloud cleanup — Remove unauthorized IAM policies, Lambda functions, S3 bucket policies

# Find and remove attacker scheduled tasks (Windows)
Get-ScheduledTask | Where-Object {
    $_.Date -gt "2026-04-08" -and
    $_.Author -notmatch "SYSTEM|Microsoft"
} | ForEach-Object {
    Write-Host "Removing suspicious task: $($_.TaskName)"
    Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false
}

Phase 4: Forensics — Evidence & Timeline

Forensics runs in parallel with response. The golden rule: preserve first, analyze second.

Evidence Collection Priority

AI-Assisted Timeline Reconstruction

def build_attack_timeline(log_entries, memory_artifacts, network_captures):
    """Use AI to reconstruct a unified attack timeline."""
    client = anthropic.Anthropic()

    evidence = f"""LOG ENTRIES (sorted by time):
{log_entries}

MEMORY ARTIFACTS:
{memory_artifacts}

NETWORK CAPTURES (summary):
{network_captures}"""

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=4000,
        messages=[{"role": "user", "content": f"""Reconstruct a forensic timeline
from this evidence. For each event:

- Timestamp (UTC)
- Source of evidence
- Action taken by attacker
- MITRE ATT&CK technique
- Confidence level (confirmed/probable/possible)
- Gaps or missing evidence

Also identify:
- Earliest confirmed compromise time
- Dwell time estimate
- Data at risk / confirmed exfiltrated
- Any evidence of anti-forensics

{evidence}"""}]
    )
    return response.content[0].text

Scenario Timeline: Operation Shadow Breach

Dwell time before detection: 3 minutes. Dwell time before containment: 46 minutes.

Threat Modeling: STRIDE & DREAD

After the incident, use threat modeling to understand what went wrong and what else could go wrong.

AI-Assisted Threat Modeling

def ai_threat_model(system_description, known_vulnerabilities):
    """Use AI to perform STRIDE/DREAD analysis."""
    client = anthropic.Anthropic()

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=4000,
        messages=[{"role": "user", "content": f"""Perform a threat model for this system.

SYSTEM:
{system_description}

KNOWN VULNERABILITIES / RECENT INCIDENTS:
{known_vulnerabilities}

For each component, apply STRIDE analysis:
1. Identify threats per STRIDE category
2. Score each using DREAD (1-10 per dimension)
3. Calculate overall risk score
4. Recommend mitigations prioritized by risk
5. Identify trust boundaries and data flows at risk

Format as a structured report suitable for both
technical and management audiences."""}]
    )
    return response.content[0].text

STRIDE Analysis: Operation Shadow Breach

Building a Complete Monitoring Stack

A production-grade security monitoring stack integrates open-source and commercial tools, unified by a central SIEM with AI analytics.

# Complete security monitoring stack
monitoring_stack:
  siem:
    primary: "Elastic Security (ELK)"
    retention: "90 days hot, 1 year warm, 7 years cold"
    ai_integration: "LLM API for alert enrichment"

  network:
    ids: "Suricata"
    traffic_analysis: "Zeek"
    flow_collection: "ntopng / NetFlow"
    packet_capture: "Arkime (full PCAP)"
    dns_monitoring: "passivedns + Pi-hole logs"

  endpoint:
    edr: "Wazuh / CrowdStrike"
    sysmon: "SwiftOnSecurity config"
    auditd: "STIG-compliant rules"
    fim: "OSSEC file integrity"

  cloud:
    aws: "CloudTrail + GuardDuty + Config"
    log_aggregation: "CloudWatch → Elastic"

  threat_intel:
    feeds: ["MISP", "AlienVault OTX", "abuse.ch"]
    enrichment: "AI-powered IOC correlation"

  automation:
    soar: "Shuffle / TheHive + Cortex"
    playbooks: "AI-generated, human-approved"

Monitoring Stack Data Flow

┌─────────────┐  ┌──────────────┐  ┌──────────────┐
│  Endpoints   │  │   Network    │  │    Cloud     │
│  (Sysmon,    │  │  (Suricata,  │  │ (CloudTrail, │
│   Wazuh)     │  │   Zeek)      │  │  GuardDuty)  │
└──────┬───────┘  └──────┬───────┘  └──────┬───────┘
       │                 │                 │
       └─────────────────┼─────────────────┘
                         ▼
              ┌─────────────────────┐
              │   Log Aggregation   │
              │  (Logstash/Fluentd) │
              └──────────┬──────────┘
                         ▼
              ┌─────────────────────┐
              │   Elastic Security  │◄──── Threat Intel Feeds
              │       (SIEM)        │       (MISP, OTX)
              └──────────┬──────────┘
                         ▼
              ┌─────────────────────┐
              │   AI Correlation    │
              │   (LLM Analysis)    │
              └──────────┬──────────┘
                         ▼
              ┌─────────────────────┐
              │   SOAR Platform     │──── Automated Playbooks
              │ (TheHive + Cortex)  │──── Analyst Notifications
              └─────────────────────┘

Security Metrics & KPIs

You cannot improve what you do not measure. These metrics prove the value of your SOC and guide investment decisions.

Measuring AI Impact on SOC Performance

AI does not just make analysts faster — it fundamentally changes what a SOC team can achieve. These numbers are the language that justifies budget to leadership.

Phase 5: Hardening — Closing the Gaps

Every incident is a lesson. Hardening transforms incident findings into permanent defensive improvements.

Post-Incident Hardening Actions

1. Patch management — Emergency patch for Apache Struts; review patch SLAs for all internet-facing services
2. Network segmentation — Isolate web tier from internal network; restrict SMB to necessary paths only
3. DNS security — Deploy DNS-over-HTTPS monitoring; add anomaly detection for TXT record queries
4. Credential hardening — Enforce MFA for all admin accounts; deploy credential guard on Windows endpoints
5. Cloud security — Restrict AssumeRole to known IPs; enable CloudTrail log file validation
6. Detection rules — Add 12 new SIEM rules based on observed TTPs

AI-Generated Detection Rules

def generate_detection_rules(incident_ttps, log_format="sigma"):
    """Generate new detection rules from incident findings."""
    client = anthropic.Anthropic()

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=4000,
        messages=[{"role": "user", "content": f"""Based on these TTPs observed
during an incident, generate detection rules in {log_format} format.

OBSERVED TTPs:
{incident_ttps}

For each rule provide:
1. Rule in {log_format} format
2. MITRE ATT&CK mapping
3. Expected false positive sources
4. Tuning recommendations
5. Severity and confidence levels

Generate rules that would have caught this attack EARLIER."""}]
    )
    return response.content[0].text

Example AI-Generated Sigma Rule

title: DNS TXT Query Volume Anomaly
status: experimental
description: Detects high volume DNS TXT queries indicating possible data exfil
logsource:
    category: dns
detection:
    selection:
        query_type: "TXT"
    timeframe: 5m
    condition: selection | count(query) by src_ip > 50
level: high
tags:
    - attack.exfiltration
    - attack.t1048.001

Continuous Improvement: Threat Intelligence Feeds

Static defenses lose effectiveness over time. Continuous improvement means your defenses evolve as fast as the threat landscape.

AI-Updated Detection Pipeline

def update_detections_from_threat_intel(new_iocs, existing_rules):
    """Use AI to merge new threat intel into existing detection rules."""
    client = anthropic.Anthropic()

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=3000,
        messages=[{"role": "user", "content": f"""Review these new IOCs from
threat intelligence feeds and recommend updates to our detection rules.

NEW THREAT INTELLIGENCE:
{new_iocs}

EXISTING RULES (summary):
{existing_rules}

For each recommendation:
1. Which existing rule to update (or new rule needed)
2. Specific changes to make
3. Rationale tied to threat actor behavior
4. Risk of false positives from the change
5. Priority (deploy immediately / next maintenance window / backlog)"""}]
    )
    return response.content[0].text

Report Writing: Executive Summary

Every incident ends with a report. The executive summary is what leadership reads. The technical appendix is what your peers review.

def generate_executive_summary(incident_data):
    """Generate an executive-friendly incident summary."""
    client = anthropic.Anthropic()

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=2000,
        messages=[{"role": "user", "content": f"""Write an executive summary
for this security incident. The audience is C-suite and board members.

INCIDENT DATA:
{incident_data}

Requirements:
- No jargon — explain technical terms in business language
- Lead with business impact (financial, operational, reputational)
- Include timeline with key milestones
- State what data was at risk and what was confirmed compromised
- Summarize response actions and their effectiveness
- List top 3 investment recommendations with cost/benefit
- Keep under 500 words
- Professional, factual tone — no speculation without labeling it"""}]
    )
    return response.content[0].text

Report Writing: Technical Report Structure

Full Technical Incident Report Outline

1. Executive Summary — Business impact, key findings, recommendations
2. Incident Overview — Classification, severity, scope, affected systems
3. Timeline — Minute-by-minute chronology with evidence sources
4. Attack Chain Analysis — MITRE ATT&CK mapping, full kill chain walkthrough
5. Technical Findings — IOCs, malware analysis, vulnerability details
6. Response Actions — What was done, when, by whom, and the outcome
7. Forensic Evidence — Chain of custody, artifacts collected, analysis results
8. Root Cause Analysis — Why it happened, contributing factors
9. Lessons Learned — What worked, what did not, what to change
10. Recommendations — Prioritized hardening actions with timelines and owners
11. Appendices — Full IOC list, raw logs, tool output, Sigma rules created

Combining All Tools & Techniques

The capstone challenge requires you to use every major tool and technique from the course. Here is the integrated toolkit.

CTF Capstone Challenge: Operation Iron Shield

Challenge Phases

1. Phase A: Detection (60 min) — Analyze provided SIEM alerts, PCAP files, and log bundles. Identify all attack stages and map to MITRE ATT&CK.
2. Phase B: Response (60 min) — Write and execute containment commands. Generate an AI-assisted response playbook. Document every action taken.
3. Phase C: Forensics (60 min) — Build a complete attack timeline from evidence. Identify IOCs, determine data exposure, perform memory analysis.
4. Phase D: Harden & Report (60 min) — Create detection rules for observed TTPs. Write both executive and technical reports. Propose a 90-day hardening plan.

Capstone: Attack Scenario Details

The Attack You Will Face

• Stage 1 — Initial Access: Spear-phishing email with macro-enabled document targeting HR department
• Stage 2 — Execution: Macro drops PowerShell loader, establishes C2 via HTTPS to legitimate-looking domain
• Stage 3 — Privilege Escalation: PrintNightmare exploit against unpatched print server
• Stage 4 — Lateral Movement: Pass-the-hash across internal network using domain admin credentials
• Stage 5 — Collection: Access to patient database, research file shares, email archives
• Stage 6 — Exfiltration: Data staged and exfiltrated via encrypted channel to cloud storage
• Stage 7 — Impact: Ransomware deployment to 40% of endpoints as a diversion

Capstone: Provided Materials

What You Receive

• SIEM export — 2,400 alerts from a 6-hour window (JSON format)
• PCAP files — Network captures from DMZ and internal segments (4 files, ~500MB)
• Windows Event Logs — Security, Sysmon, PowerShell logs from 8 key hosts (EVTX)
• Memory dump — RAM capture from compromised HR workstation (4GB, Lime format)
• CloudTrail logs — 48 hours of AWS API activity (JSON)
• Email headers — Original phishing email with full headers
• Network diagram — Topology of the target environment
• Asset inventory — All systems with OS versions, roles, and patch levels

Scoring Rubric: Phase A — Detection

Phase A Total: 60 points

Scoring Rubric: Phase B — Response

Phase B Total: 45 points

Scoring Rubric: Phases C & D

Phase C — Forensics (45 points)

Phase D — Harden & Report (50 points)

Grand Total: 200 points

Evaluation Criteria: Grading Scale

Bonus Points (up to 20)

• +5 — Creative use of AI beyond suggested patterns
• +5 — Identifying attacker infrastructure or attribution clues
• +5 — Proposing detection rules that catch the attack at Stage 1
• +5 — Exceptional report quality (presentation-ready for a real board meeting)

Capstone Tips & Strategy

Course Conclusion: The AI-Augmented Defender

Over 10 lessons, you have built a complete defensive skill set enhanced by AI at every stage. Here is what you now know how to do:

• Monitor — Build and operate a multi-layer security monitoring stack
• Detect — Write detection rules and use AI for cross-layer correlation
• Analyze — Triage alerts, hunt threats, and interpret complex evidence
• Respond — Execute containment, eradication, and recovery under pressure
• Investigate — Perform digital forensics with proper evidence handling
• Harden — Transform incident findings into permanent defensive improvements
• Report — Communicate findings to both technical and executive audiences
• Automate — Use AI to accelerate every phase of the defense lifecycle