# Blue Team

> Blue team defense using Deep Eye outputs for detection engineering, IR content, and hardening. Use for blue team, SOC, SIEM, detection engineering, threat hunting, IR triage, hardening, /blue-team.

- Skill: `zakirkun/blue-team` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zakirkun/blue-team`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/blue-team/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/blue-team

---


# Deep Eye — Blue Team Skill

Deep Eye = controlled attack corpus for detection and control validation.

## Generate corpus

```bash
python deep_eye.py -u https://STAGING -v --formats json,sarif
```

Useful noisy checks: `sql_injection`, `xss`, `ssrf`, `ssrf_cloud`, `log4shell`, `lfi`, `crlf_injection`, smuggling modules.

## Detection loop

1. Take High finding (`payload`, `url`, `type`)
2. Write SIEM/WAF rule
3. Replay scan / single request
4. Measure FPs
5. Document owner

## Control validation

| Finding | Control |
|---------|---------|
| IDOR/BOLA | Object-level authz |
| JWT | Alg lockdown, signature verify |
| SSRF | Egress / metadata block |
| XSS | CSP + encoding |
| Secrets | Scanner + CI secret scan |

## Retest

```bash
python deep_eye.py -u URL --retest-new reports/prior.json
```

## Rules

Do not disable prod controls only to silence scans; coordinate SOC windows.