What the Blue Team Does: Five Functions, Tiers and the Alert Queue

All courses / AI Blue / Module 1 / Chapter 2

Learning objectives

After the lesson the participant can:

Define the five blue team functions and apply the four boundaries the chapter draws between them
Explain the four assumptions on which the tiered SOC and its queue rest
Identify what each common SOC measure rewards when it is used alone
Draft a function map that records owners, tools, automation without a reader and craft

Key concepts

Function map: The first artefact of the book: for each of the five functions it names who performs it, with which tools and data location, which parts already run without a person reading, who agreed to them, the current measures and the parts judged to be craft.
Boundary between B2 Detect and B3 Investigate: Triage belongs to B3 Investigate, not to B2 Detect. B2 answers for whether the alert should exist; B3 answers for what it means.
Four assumptions of the tiered SOC: Volume is handled by headcount, skill is acquired by doing the routine, the queue is the interface, and a person reads each alert. Chapters 5 to 11 test these assumptions.
Craft and routine: Routine is work that follows a known procedure, is repeated in the same form and can be checked against a rule. Every function contains both craft and routine, and the transformation is a redistribution between them.
Automation without a reader: The parts of a function that already close or act without a person reading, whether vendor features, SOAR playbooks or a provider's processes. They form the Mode 0 and automation baseline and need a named person who accepted them.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Craft or routine?

Sort each piece of blue team work as the chapter's first judgement does: mostly routine or mostly craft.

Interactive exercise 2 · Match

Six tools and what they carry

Match each kind of tool in the baseline SOC with what the chapter says it holds or does.

Teaching plan

15 min	Teacher presentation of the seven recurring roles, the five functions as a loop and their mapping to the CSF 2.0 Functions and Categories.
10 min	Sorting task: participants place ten everyday tasks, such as triage, containment and a hunt, in the right function using the four boundaries.
15 min	Group reading of the measures table; each group names one behaviour a measure rewards if used alone and how AI would amplify it.
25 min	Exercise: participants write a function map for their own team or complete Nordvik Region's map from the chapter's profile.
10 min	Plenary comparison of the maps with the worked example, focusing on unowned functions and entries where acceptance was not recorded.

Discussion

The chapter says the function, not the job title, is the unit of the book. What does your organisation lose or gain when it describes its security work by function instead of by title?
Tier 1 is both where the queue is worked and where analysts learn. What happens to each purpose if the routine is automated?
Security telemetry records what named people did. How does that fact change who should be in the room when the team introduces an AI capability?

Written exercise

Exercise · 25 minutes

Mapping a team's work

Follow the eight steps of the chapter's practical guide. List the five functions as rows. For each, name the person or provider who performs it today, or record it as unowned. Record the tools and where the data sits, the tier or role and the hours covered. Mark the parts that already run without a person reading and who agreed to them, the current measures and who sees them, and the parts you judge to be craft, with a short reason. Give every row a review date no more than six months ahead. Use your own team, or Nordvik Region, where the chapter shows a phishing-report classifier in the email gateway with acceptance not recorded.

Deliverable: A five-row function map with owner, tools, data location, hours, automation without a reader and who accepted it, measures, craft and review date.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

To which function does the chapter assign triage, and why?
Show the answer
C. B3 Investigate, because B2 answers for whether the alert should exist and B3 for what it means
The first of the chapter's four boundaries places triage in B3 Investigate: detection answers for the existence of the alert, investigation for its meaning.
What does Nordvik Region's function map show before any transformation begins?
Show the answer
A. An automation that closes alerts and that nobody accepted for the Region, and three unowned functions
Nordvik's map records 'accepted_by: not recorded' and B1, B4 and B5 as owned by nobody in a sense that could be written down. The other options describe Hansa Mutual.
What does the chapter say about the measures a SOC traditionally reports, such as mean time to detect, mean time to respond and closure rate?
Show the answer
D. They count speed, volume or coverage, and none counts the quality of a judgement
The chapter calls the measures useful but notes that each counts speed, volume or coverage. When AI makes closing and acting cheap, the numbers can improve while what they indicate does not.