Which defense team focuses on detecting and responding to incidents within an organization?

• A. Blue Team
• B. Red Team
• C. Purple Team
• D. Orange Team

Answer: (A)

Detecting and responding to incidents within an organization is the work of the Blue Team. They act as the defenders, continuously monitoring networks and systems, using security information and event management (SIEM) tools, and keeping an eye on logs and alerts to identify threats. When an incident is detected, the Blue Team executes the incident response process—containing the threat, eradicating it, recovering normal operations, and preserving evidence for analysis. This focus on defense, detection, and response within the organization contrasts with the Red Team, which emulates attackers to test defenses; the Purple Team, which pairs blue and red activities to improve capabilities through collaboration; and the less common Orange Team, which isn’t a standard designation for this context.