Download the free Kindle app and start reading Kindle books instantly on your smartphone, tablet, or computer - no Kindle device required.
Read instantly on your browser with Kindle for Web.
Using your mobile phone camera - scan the code below and download the Kindle app.
-
-
-
Image Unavailable
Image not available for
Color:
Follow the author
OK
Blue Team Handbook: Incident Response
Purchase options and add-ons
As cyberthreats grow and infrastructure evolves, organizations must prioritize effective, dynamic, and adaptable incident response. Following the success of the original edition, Blue Team Handbook: Incident Response has been updated to reflect today's evolving cybersecurity landscape. This trusted and widely used field guide for cybersecurity incident responders, SOC analysts, and defensive security professionals distills incident response essentials into a concise, field-ready format.
Author Don Murdoch draws on decades of real-world experience in incident response and cybersecurity operations to provide actionable guidance and sample workflows you can immediately apply in your own work. Whether you're investigating an alert, analyzing suspicious traffic, or strengthening your organization's IR capability, you'll find this field-tested edition an essential resource for hands-on practitioners.
- Understand how modern adversaries operate and recognize common indicators of compromise in networks
- Analyze network traffic with common tools to identify and investigate suspicious activity
- Execute structured incident response procedures and follow a clear response plan
- Conduct basic forensic analysis on both Windows and Linux systems
- Use proven methodologies and tools to carry out effective, dynamic incident response
- ISBN-13979-8341661264
- Edition1st
- PublisherO'Reilly Media
- Publication dateMarch 24, 2026
- LanguageEnglish
- Dimensions7 x 2 x 9.19 inches
- Print length356 pages
Customers who viewed this item also viewed
- Blue Team Handbook: SOC, SIEM, and Threat Hunting: Practical Techniques for Security Operations and Threat Hunting TeamsPaperbackFREE Shipping by AmazonGet it as soon as Monday, Nov 2Only 11 left in stock (more on the way).
- Blue Team Handbook: Incident Response, 3rd Edition: A condensed field guide for the Cyber Security Incident Responder.PaperbackFREE Shipping by AmazonGet it as soon as Monday, Nov 2
- Defensive Security Handbook: Best Practices for Securing InfrastructurePaperbackGet it as soon as Sunday, Nov 15
- Intelligence-Driven Incident Response: Outwitting the AdversaryPaperbackFREE Shipping by AmazonGet it as soon as Monday, Nov 2Only 16 left in stock (more on the way).
- Blue Team Field Manual (BTFM) (Field Manual Series)PaperbackFREE Shipping on orders over $35 shipped by AmazonGet it as soon as Monday, Nov 2
Customers also bought or read
- Blue Team Handbook: SOC, SIEM, and Threat Hunting: Practical Techniques for Security Operations and Threat Hunting Teams
Just releasedPaperback$64.67$64.67FREE delivery Mon, Nov 2 - Blue Team Handbook: SOC, SIEM, and Threat Hunting (V1.02): A Condensed Guide for the Security Operations Team and Threat Hunter
Paperback$40.03$40.03FREE delivery Nov 5 - 9 - Defensive Security Handbook: Best Practices for Securing Infrastructure
Paperback$27.78$27.78Delivery Nov 15 - Dec 2 - Agentic AI for Offensive Cybersecurity: Build and automate smarter penetration testing workflows using AI-driven agents
Paperback$35.99$35.99FREE delivery Mon, Nov 2 - Dynamic Incident Response: A Framework for Security Teams
Just releasedPaperback$23.09$23.09Delivery Mon, Nov 2 - Red Team Engineering: The Art of Building Offensive Tools and Infrastructure
Paperback$50.14$50.14FREE delivery Wed, Nov 4 - Intelligence-Driven Incident Response: Outwitting the Adversary
Paperback$44.92$44.92FREE delivery Mon, Nov 2 - Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Paperback$50.81$50.81FREE delivery Nov 8 - 12 - Advanced Cyber Threat Intelligence and Hunting: Detect APTs and zero-day attacks using CTI, behavioral analytics, and AI techniques
Paperback$39.99$39.99FREE delivery Mon, Nov 2 - Practical AI Security: A Hands-on Guide to Attacking, Defending, and Securing Modern AI Systems
Paperback$44.46$44.46FREE delivery Mon, Nov 2 - Digital Forensics Cookbook: Field-Tested Recipes for Real-World Investigations Across Windows, macOS, Linux, iOS, and Android
Paperback$35.99$35.99FREE delivery Mon, Nov 2 - Cybersecurity Strategy for the AI-Driven Era: Proven strategies and data-driven tactics to disrupt attacks and strengthen enterprise defenses
Paperback$47.99$47.99FREE delivery Mon, Nov 2 - CompTIAÂŪ Security+ÂŪ SY0-801 Certification Guide: Build essential cybersecurity skills and pass the SY0-801 exam on your first attempt#1 New ReleaseSecurity Certifications
Paperback$35.99$35.99FREE delivery Mon, Nov 2 - Dissecting the Dark Web: Reverse Engineering the Tools of the Underground Economy
Paperback$47.24$47.24FREE delivery Mon, Nov 2 - Heavy Wizardry 101: Shellcodes, Backdoors, Droppers, and Worms
Hardcover$45.02$45.02FREE delivery Mon, Nov 2 - Evasion Engineering: Building Custom Red Team Tools for Modern Defenses
Paperback$43.39$43.39FREE delivery Tue, Nov 3 - Mastering PowerShell Scripting: Automate repetitive tasks and simplify complex administrative tasks using PowerShell
Paperback$32.49$32.49Delivery Mon, Nov 2 - The Practice of Network Security Monitoring: Understanding Incident Detection and Response
Paperback$45.55$45.55FREE delivery Tue, Nov 3 - Digital Forensics and Incident Response: Incident response tools and techniques for effective cyber threat response
Paperback$54.99$54.99FREE delivery Mon, Nov 2 - The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws
Paperback$25.36$25.36Delivery Tue, Nov 3 - Practical Threat Intelligence and Data-Driven Threat Hunting: A hands-on guide to threat hunting with the ATT&CKâĒ Framework and open source tools
Paperback$44.99$44.99FREE delivery Mon, Nov 2 - Web Application Security: Exploitation and Countermeasures for Modern Web Applications
Paperback$36.31$36.31FREE delivery Mon, Nov 2 - Cybersecurity Tabletop Exercises: From Planning to Execution
Paperback$42.64$42.64FREE delivery Wed, Nov 4
From the brand
-
Explore security resources
-
More From O'Reilly
-
Sharing the knowledge of experts
O'Reilly's mission is to change the world by sharing the knowledge of innovators. For over 40 years, we've inspired companies and individuals to do new things (and do them better) by providing the skills and understanding that are necessary for success.
Our customers are hungry to build the innovations that propel the world forward. And we help them do just that.
From the Publisher
From the Preface
Who Should Read This Book
Incident response is a critical aspect of security operations and follows a well-structured process. Incident responders often find themselves needing key pieces of information or thought processes to safely move on to the next phase, all the while realizing that continued discovery can cause rescoping of the incident. Blue Team Handbook provides responders with immediately applicable techniques to handle security incidents today and is filled with life lessons learned from the field. Whether you are new to the field, work in a security operations center and want to move up to the next level, or are a seasoned pro, there is something here for you to up your game.
Navigating This Book
Chapter 1 provides several working definitions of incident response and then covers two aspects of how IR has changed to respond to todayâs threat actors. Next, it presents several topics that help define some of the key thought processes for IR with time-based security: a discussion of how to leverage the MITRE ATT&CK framework and an outline of how adversaries operate today.
Chapter 2 presents the overall recipe for the IR process. The chapter offers a checklist for all the phases, from Preparation to Lessons Learned, to help you apply a structure and framework to your IR processes.
Chapter 3 covers a wide variety of skills and tactics that augment the entire IR process, ranging from roles to templates to the traffic light protocol for information sharing.
Chapter 4 provides an overview of adversary tactics, tools, and procedures, most of which can be encountered during an actual incident.
Chapters 5, 6, and 7 go over specific technical aspects of the IR process and examine various platforms. Chapter 5 covers Windows examination using a variety of command-line tools; Chapter 6 focuses on triage and collecting volatile data on Linux systems; and Chapter 7 discusses PowerShell.
Chapter 8 provides information on analyzing Active Directory.
Chapter 9 covers network examinations at the packet capture and traffic levels.
Chapter 10 discusses Endpoint Detection and Response capabilities.
The book also includes appendices with reference materials, including a list of common TCP and UDP ports.
Blue Team Handbook
|
Blue Team Handbook
|
|
|---|---|---|
|
Add to Cart
|
Add to Cart
|
|
| Blue Team Handbook by Don Murdoch | Incident Response | SOC, SIEM, and Threat Hunting |
Editorial Reviews
About the Author
Product details
- ASIN : B0FMNLPL8Q
- Publisher : O'Reilly Media
- Publication date : March 24, 2026
- Edition : 1st
- Language : English
- Print length : 356 pages
- ISBN-13 : 979-8341661264
- Item Weight : 1.26 pounds
- Dimensions : 7 x 2 x 9.19 inches
- Best Sellers Rank: #680,129 in Books (See Top 100 in Books)
- #125 in Computer Viruses
- #245 in Computer Network Administration
- #291 in Privacy & Online Safety
- Customer Reviews:
About the author

Blue Team Handbook: Incident Response Edition: Voted "One of the best Cyber Security books of all time (3/100)" - BookAuthority.org
LINK TO NEW BTHb:SOC, SIEM (Ver 1.02): https://www.amazon.com/dp/1091493898
Customer reviews
- 5 star4 star3 star2 star1 star4 star100%0%0%0%0%0%
- 5 star4 star3 star2 star1 star3 star100%0%0%0%0%0%
- 5 star4 star3 star2 star1 star2 star100%0%0%0%0%0%
- 5 star4 star3 star2 star1 star1 star100%0%0%0%0%0%
Customer Reviews, including Product Star Ratings help customers to learn more about the product and decide whether it is the right product for them.
To calculate the overall star rating and percentage breakdown by star, we donât use a simple average. Instead, our system considers things like how recent a review is and if the reviewer bought the item on Amazon. It also analyzed reviews to verify trustworthiness.
Learn more how customer reviews work on Amazon


















