## Blue Team Defense

The Blue Team has the harder job. The Red Team only needs to be right *once*. The Blue Team needs to be right *every time*.

### 1. Prevention (Hardening)
*   "Reduce the attack surface."
*   Disable macros.
*   Patch vulnerabilities.
*   Enforce MFA.

### 2. Detection (Monitoring)
*   SIEM rules.
*   Honeypots (Traps).
*   Canary Tokens (Fake files that alert when opened).

### 3. Response (IR)
*   The fire brigade.

### The "Assume Breach" Mentality
Modern Blue Teams assume the perimeter has failed. They focus on **Internal Monitoring**.
*   "I don't care if they get in. I care if they can move to the database without me seeing them."