También: soc, blue team

Day-to-day defensive work in a SOC. Covers alert triage and investigation, log and endpoint telemetry, threat hunting, incident containment, and tuning detection rules.