This chapter describes the blue team as it works before the transformation the rest of the book follows: what it does, how it is organised around a queue, which tools carry the work, who its neighbours are and how it is measured. It defines the five blue team functions that every later chapter uses, B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, and maps them to the Functions of the NIST Cybersecurity Framework (CSF) 2.0 and to the roles of a typical team. It concerns all five. The point of the baseline is practical: a change can only be judged against a description of what was there before, and the description has to be specific enough that Nordvik Region and Hansa Mutual can recognise their own teams in it. The chapter also separates craft from routine, because that separation is what Chapters 5 to 11 test function by function and Chapter 4 turns into degrees of delegation.
A blue team is the set of people and functions that defend an organisation: they watch, decide whether what they see matters, contain what does and change the defences afterwards. The term sits beside two others that this book keeps distinct. A red team emulates an adversary, under written rules of engagement, to test the defence. A purple team is the joint loop between the two in which a finding becomes a better detection, a better playbook or a better decision right (64, Nordqvist, 2026). The blue team is the party that owns the result.
In most organisations the blue team is not a single department. Its core is usually a security operations centre (SOC), the group of analysts who monitor telemetry and work the alerts that detections raise. Around the core sit specialists who the SOC depends on and who are sometimes inside it and sometimes beside it: engineers who write and maintain detections, analysts who read threat intelligence, an incident-response capability that leads the serious cases, and a forensic capability that preserves and examines evidence. In a small organisation one person may hold several of these roles, and in a large one each has a team of its own.
Primary topics explored
- What defenders do
- Five blue team functions
- Tiers, shifts and the queue
- Tools and data
- Neighbours and handovers
- How the work is measured
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 2: What the Blue Team Does: Five Functions, Tiers and the Alert Queue in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Blue Team in Question” and is one of 32 drawn from the manuscript.