c4.12 Establish a blue team
A blue team is your incident-response specialists, active across the whole lifecycle: prepare, identify, contain, eradicate, recover, and learn. In the cloud they should invest heavily in automating remediation — AWS reports the vast majority of its own infrastructure security events are resolved automatically.
Implementation guidance
The blue team works across the incident lifecycle
Responding to GuardDuty findings was recommended from the earliest phases, but a blue team does far more than react. It operates across the lifecycle:
- Prepare — threat modeling, and ensuring the logs and evidence needed for investigation are being collected.
- Identify — monitoring alerts from threat detection and your SIEM.
- Contain — isolating attackers to limit impact.
- Eradicate — removing all adversary access.
- Recover — returning to a known-good state.
- Learn — documenting lessons learned and improving.
The name comes from military exercises: a "red" force plays the enemy and a "blue" team defends.
Automate response to scale
Cloud incident response differs from on-premises: the technical context needed for decisions is available programmatically through services like AWS Config and AWS CloudTrail, enabling a much higher degree of automation. AWS has publicly noted that the vast majority of its own infrastructure security events are resolved automatically without human intervention. So the blue team should invest heavily in automating remediation — especially for the most recurring and highest-impact incidents — and keep humans focused on judgment.
How to validate
- Do you have a blue team that works across the full incident lifecycle (prepare, identify, contain, eradicate, recover, learn)?
- Are the logs and evidence needed for investigation collected in advance?
- Is the team investing in automated remediation for recurring and high-impact incidents?
Threats addressed
- A team that only reacts to alerts, without preparation, containment discipline, and automation, responds slowly and inconsistently — letting incidents spread and recur.
AWS services
AWS CloudTrail 
AWS Config 
AWS Security Hub