Blue Team Handbook: Incident Response Edition: a Condensed Field Guide for the Cyber Security Incident Responder. 2nd edition

Updated, Expanded, and released to print on 10/5/14! Complete details below! Two new sections, five protocol header illustrations, improved formatting, and other corrections.

The Blue Team Handbook is a zero fluff reference guide for cyber security incident responders and InfoSec pros alike. The BTHb includes essential information in a condensed handbook format about the incident response process, how attackers work, common tools, a methodology for network analysis developed over 12 years, Windows and Linux analysis processes, tcpdump usage examples, Snort IDS usage, and numerous other topics. The book is peppered with practical real life techniques from the authors extensive career working in academia and a corporate setting. Whether you are writing up your cases notes, analyzing potentially suspicious traffic, or called in to look over a misbehaving server ? this book should help you handle the case and teach you some new techniques along the way.

Version 2.0 updates:
- *** A new section on Database incident response was added.
- *** A new section on Chain of Custody was added.
- *** Matt Baxter's superbly formatted protocol headers were added!
- Table headers bolded.
- Table format slightly revised throughout book to improve left column readability.
- Several sentences updated and expanded for readability and completeness.
- A few spelling errors were corrected.
- Several sites added to the Web References section.
- Illustrations reformatted for better fit on the page.
- An index was added.
- Attribution for some content made more clear (footnotes, expanded source citing)
- Content expanded a total of 20 pages