Blue Team

Blue teaming is defence: detecting, investigating and responding to threats, and hardening systems so attacks fail. Use Oyster’s Blue Team workspace for CVE triage, detection engineering, incident investigation and response planning. It needs an account and is in the sidebar under Blue Team.

The tools

Tool	What it is for
SOC Copilot	A case-based investigation workbench: evidence, detections, network data, timeline, indicators, MITRE ATT&CK mapping, playbooks and reports.
Security Intel	Exact lookups of CVE, CWE, CAPEC, ATT&CK and D3FEND entries, known exploited vulnerabilities, and detection, mitigation and response questions — with sources.
Cook Book	Playbook templates you can attach to a case, copyable shortcuts, ATT&CK detection cards and triage checklists.
Notes	Your own working notes.
Shield	A read-only reference for a separate scanner you run yourself. Nothing executes inside Oyster.

Common tasks

• Investigate a CVE
• Work with logs and indicators
• Turn evidence into a response plan

Example requests

• “Investigate CVE-2021-44228: severity, exploitation, affected versions, and how to detect it.”
• “Write a Sigma rule to detect PowerShell encoded-command execution and explain each condition.”
• “I have these indicators from an alert — which ATT&CK techniques do they map to, and what should I check next?”
• “Turn this incident evidence into a containment and remediation plan.”