Defensive Operations (Blue Team)
Overview
Section titled “Overview”Defensive operations simulates a live cyber incident where you must detect, contain, and remediate an ongoing attack. This tests your incident response, threat hunting, monitoring, and rapid remediation skills under time pressure.
Duration: 4 hours
Typical marks distribution:
- Incident detection & triage: 35-40%
- Containment actions: 25-30%
- Threat hunting & IOC correlation: 20-25%
- Patch deployment & remediation: 10-15%
What You’ll Face
Section titled “What You’ll Face”Incident Response
Section titled “Incident Response”- Identify compromised systems from logs/alerts
- Determine attack timeline (initial access → persistence → exfil)
- Isolate affected systems
- Collect evidence without disrupting business
- Write incident report with root cause analysis
SIEM & Monitoring
Section titled “SIEM & Monitoring”- Analyse SIEM alerts (Splunk, ELK, Sentinel)
- Correlate logs across multiple sources
- Create detection rules for specific attacks
- Tune rules to reduce false positives
- Identify attack patterns in real-time
Threat Hunting
Section titled “Threat Hunting”- Hunt for IOCs (IP addresses, file hashes, domains)
- Identify lateral movement in network logs
- Detect persistence mechanisms (scheduled tasks, services)
- Find unauthorized user accounts
- Identify data exfiltration
Live Response & Remediation
Section titled “Live Response & Remediation”- Deploy emergency firewall rules
- Block malicious IPs/domains
- Patch vulnerable systems under attack
- Remove malware/backdoors
- Restore services after containment
Competition Strategy
Section titled “Competition Strategy”Time allocation:
- First 30 minutes: Triage and understand the incident
- Next 60 minutes: Identify all compromised systems and IOCs
- Next 60 minutes: Containment actions (firewall, patching, isolation)
- Final 30 minutes: Documentation and reporting
Common pitfalls:
- Acting before understanding (blocking wrong IPs, breaking services)
- Not documenting actions (screenshots of firewall rules, patch deployments)
- Focusing on symptoms, not root cause
- Incomplete remediation (missing persistence mechanisms)
Topics (Canonical Content)
Section titled “Topics (Canonical Content)”Content is being developed. Planned topics:
- Incident Response Fundamentals - Triage, containment, eradication
- SIEM & Monitoring - Splunk, ELK, rule creation, correlation
- Threat Hunting - IOC hunting, baseline analysis, anomaly detection
- Live Response - Firewall changes, service isolation, emergency patching
- Patch Management - Windows Update, apt, prioritization
Competency by Level
Section titled “Competency by Level”| Regional | National | International |
|---|---|---|
| Identify compromised user from logs | Multi-source log correlation | Advanced threat hunting techniques |
| Block IP in firewall | Create SIEM detection rules | Tune SIEM to eliminate false positives |
| Deploy Windows Update | Emergency patching strategy | Zero-day mitigation without patches |
| Basic incident report | Detailed timeline analysis | Root cause analysis with recommendations |
Practice Resources
Section titled “Practice Resources”Unofficial study guide, not endorsed by WorldSkills International or WorldSkills UK. Topics are example areas to prepare for, not the content of any test project: competition tasks are confidential, competitions are closed book, and formats change between competitions. More about this site.