# Blue Team

> Oyster's Blue Team workspace for defenders — SOC Copilot investigations, Security Intel lookups, the Cook Book of playbooks and checklists, Notes and Shield.

Source: https://documentation.redorca.ai/guides/blue-team/
Last updated: 2026-11-01

Blue teaming is defence: detecting, investigating and responding to threats, and hardening systems so attacks fail. Use Oyster's Blue Team workspace for CVE triage, detection engineering, incident investigation and response planning. It needs an account and is in the sidebar under **Blue Team**.

## The tools

| Tool | What it is for |
|---|---|
| [SOC Copilot](https://documentation.redorca.ai/guides/blue-team/soc-copilot/) | A case-based investigation workbench: evidence, detections, network data, timeline, indicators, MITRE ATT&CK mapping, playbooks and reports. |
| [Security Intel](https://documentation.redorca.ai/guides/security-intelligence/) | Exact lookups of CVE, CWE, CAPEC, ATT&CK and D3FEND entries, known exploited vulnerabilities, and detection, mitigation and response questions — with sources. |
| [Cook Book](https://documentation.redorca.ai/guides/blue-team/cook-book-and-notes/) | Playbook templates you can attach to a case, copyable shortcuts, ATT&CK detection cards and triage checklists. |
| [Notes](https://documentation.redorca.ai/guides/blue-team/cook-book-and-notes/) | Your own working notes. |
| [Shield](https://documentation.redorca.ai/guides/blue-team/cook-book-and-notes/#shield) | A read-only reference for a separate scanner you run yourself. Nothing executes inside Oyster. |

## Common tasks

- [Investigate a CVE](https://documentation.redorca.ai/guides/blue-team/investigate-a-cve/)
- [Work with logs and indicators](https://documentation.redorca.ai/guides/blue-team/logs-and-indicators/)
- [Turn evidence into a response plan](https://documentation.redorca.ai/guides/blue-team/response-plans/)

## Example requests

- "Investigate CVE-2021-44228: severity, exploitation, affected versions, and how to detect it."
- "Write a Sigma rule to detect PowerShell encoded-command execution and explain each condition."
- "I have these indicators from an alert — which ATT&CK techniques do they map to, and what should I check next?"
- "Turn this incident evidence into a containment and remediation plan."