Lessons Learned: Getting Started with Blue Teaming via TryHackMe's "Defensive Security Intro"

As I continue my journey into cybersecurity, I recently explored the Defensive Security Intro room on TryHackMe. While offensive security often gets the spotlight, this room reminded me of the critical importance of defensive strategies—the unsung heroes of cyber resilience.

Here’s a walkthrough of the room and the key lessons I learned.

🧭 Room Overview
The Defensive Security Intro room is a beginner-friendly, theory-based module that introduces the core concepts of blue teaming—the practice of defending systems from cyber threats. It’s perfect for anyone curious about how organizations detect, respond to, and recover from attacks.

🔐 Walkthrough & Key Concepts
🧱 Task 1: What is Defensive Security?
This task lays the foundation by explaining the CIA Triad—Confidentiality, Integrity, and Availability. These three principles guide all defensive strategies.

🧠 Lesson:
Defensive security is proactive and reactive.
It’s not just about firewalls—it's about monitoring, detection, and response.

🧰 Task 2: Tools of the Trade
This section introduces essential tools used by blue teams:

• SIEM (Security Information and Event Management): Tools like Splunk and ELK stack help collect and analyze logs.

• EDR (Endpoint Detection and Response): Tools like CrowdStrike and SentinelOne monitor endpoints for suspicious behavior.

• Firewalls & IDS/IPS: Network-level defenses that filter traffic and detect intrusions.

🧠 Lesson:
Logs are gold. Understanding how to read and correlate logs is a vital skill.
Automation is key—manual monitoring doesn’t scale.

🧪 Task 3: Incident Response Lifecycle
This task walks through the six phases of incident response:

• Preparation

• Identification

• Containment

• Eradication

• Recovery

• Lessons Learned

🧠 Lesson:
Incident response is a team sport—communication and documentation are just as important as technical skills.
The “Lessons Learned” phase is often overlooked but critical for improving defenses.

🧠 Practical Example: SIEM Simulator
We have a practical SIEM dashboard with logs from account access, our task is to spot the unauthorized access ip and proceed to block it in order to get the room flag. All the process is fully guided, well explained and quite similar to what really happen in Splunk.

📚 Key Takeaways
Defense is Deep: It’s not just about stopping attacks—it’s about understanding them, detecting them early, and responding effectively.
Tools are Powerful, but Context is King: Knowing how to interpret alerts and logs is more important than just knowing how to use a tool.
Incident Response is a Lifecycle: It’s not a one-time event. Continuous improvement is essential.
Threat Intelligence is a Force Multiplier: It turns raw data into actionable insights.

🚀 Final Thoughts
The Defensive Security Intro room is a fantastic starting point for anyone interested in blue teaming. It’s less hands-on than offensive rooms, but it lays the groundwork for understanding how real-world organizations defend against cyber threats.