|
1 | | -# 🛡️ BlueTeam-Tools |
2 | | -### DFIR · Event Logs · Incident Response · Forensic Readiness |
| 1 | +# 🔵 BlueTeam-Tools Suite |
| 2 | +### DFIR · Forensic Readiness · Security Visibility |
3 | 3 |
|
4 | | -[](https://github.com/brazilianscriptguy/Windows-SysAdmin-ProSuite) |
| 4 | +[](../) |
| 5 | +[]() |
| 6 | +[]() |
| 7 | +[]() |
5 | 8 | []() |
6 | | -[]() |
7 | | -[]() |
8 | | -[]() |
9 | | -[]() |
| 9 | +[]() |
10 | 10 |
|
11 | | -**BlueTeam-Tools** is the defensive security and forensic analysis pillar of the |
12 | | -**Windows-SysAdmin-ProSuite**, providing enterprise-grade PowerShell tooling for: |
| 11 | +--- |
| 12 | + |
| 13 | +## 🧭 Overview |
| 14 | + |
| 15 | +[]() |
| 16 | +[]() |
| 17 | +[]() |
| 18 | + |
| 19 | +The **BlueTeam-Tools Suite** is a **forensic-grade PowerShell toolkit** designed for **Blue Team**, **DFIR**, and **Cybersecurity Operations** within Windows enterprise and public-sector environments. |
13 | 20 |
|
14 | | -- 🔍 Threat detection and investigation |
15 | | -- 🧾 Windows Event Log analysis |
16 | | -- 🕵️ Incident response support |
17 | | -- 📊 Audit-ready forensic reporting |
| 21 | +It provides **repeatable**, **auditable**, and **incident-ready** tooling to support: |
| 22 | + |
| 23 | +- Live-response operations |
| 24 | +- Event correlation and threat hunting |
| 25 | +- Evidence collection and forensic readiness |
| 26 | +- Security posture validation and audit support |
| 27 | + |
| 28 | +All tools follow the same engineering principles applied across **Windows-SysAdmin-ProSuite**: |
| 29 | +**deterministic execution, structured logging, and governance alignment**. |
18 | 30 |
|
19 | 31 | --- |
20 | 32 |
|
21 | | -## 🎯 Operational Scope |
| 33 | +## 🧪 Core Capabilities |
22 | 34 |
|
23 | | -[]() |
24 | | -[]() |
25 | | -[]() |
26 | | -[]() |
| 35 | +[]() |
| 36 | +[]() |
| 37 | +[]() |
| 38 | +[]() |
27 | 39 |
|
28 | | -Designed to support: |
| 40 | +- 🔍 **Forensic Automation** |
| 41 | + Extraction of Windows Event Logs, registry artifacts, network sessions, user activity, and volatile system state. |
29 | 42 |
|
30 | | -- Security Operations Centers (SOC) |
31 | | -- DFIR teams |
32 | | -- Judicial and public-sector investigations |
33 | | -- Enterprise security audits |
34 | | -- Post-incident technical reporting |
| 43 | +- 🛡️ **Incident Response Support** |
| 44 | + Live-response data capture, evidence preservation, and correlation during active or post-incident scenarios. |
| 45 | + |
| 46 | +- 📊 **Security Visibility & Auditability** |
| 47 | + Policy validation, configuration auditing, and exportable `.csv` / `.log` artifacts suitable for compliance and investigations. |
35 | 48 |
|
36 | 49 | --- |
37 | 50 |
|
38 | | -## 🧠 Core Capabilities |
| 51 | +## 🧩 Script Categories & Architecture |
39 | 52 |
|
40 | | -[]() |
41 | | -[]() |
42 | | -[]() |
43 | | -[]() |
| 53 | +[]() |
| 54 | +[]() |
| 55 | +[]() |
44 | 56 |
|
45 | | -- Parsing and querying Windows Event Logs (EVTX) |
46 | | -- Detection of anomalous authentication behavior |
47 | | -- Timeline reconstruction of user and system activity |
48 | | -- Identification of lateral movement indicators |
49 | | -- Correlation of logon, privilege, and service events |
| 57 | +| Component | Purpose | Documentation | |
| 58 | +|---------|---------|---------------| |
| 59 | +| **EventLogMonitoring** | Security-focused analysis of Windows Event Logs, including authentication failures, privilege escalation, lateral movement indicators, and policy violations. | [](EventLogMonitoring/README.md) | |
| 60 | +| **IncidentResponse** | Live-response and post-incident utilities for volatile artifacts, active sessions, system metadata, and threat indicators. | [](IncidentResponse/README.md) | |
| 61 | + |
| 62 | +> Folder structure reflects **operational separation**, not execution order. |
50 | 63 |
|
51 | 64 | --- |
52 | 65 |
|
53 | | -## 🧩 Directory Structure |
54 | | - |
55 | | -```text |
56 | | -BlueTeam-Tools/ |
57 | | -│ |
58 | | -├─ EventLogMonitoring/ |
59 | | -│ ├─ Authentication analysis |
60 | | -│ ├─ Privilege escalation detection |
61 | | -│ └─ Logon/session correlation |
62 | | -│ |
63 | | -├─ IncidentResponse/ |
64 | | -│ ├─ Rapid triage scripts |
65 | | -│ ├─ Evidence-oriented collection |
66 | | -│ └─ Post-incident review helpers |
67 | | -│ |
68 | | -└─ README.md |
69 | | -``` |
| 66 | +## 🏛️ Scope & Target Audience |
| 67 | + |
| 68 | +[]() |
| 69 | +[]() |
| 70 | +[]() |
| 71 | +[]() |
| 72 | + |
| 73 | +Designed for professionals operating in: |
| 74 | + |
| 75 | +- Security Operations Centers (SOC) |
| 76 | +- Digital Forensics & Incident Response (DFIR) |
| 77 | +- Identity & Access Management investigations |
| 78 | +- Compliance, audit, and governance workflows |
| 79 | +- Public-sector and regulated environments |
70 | 80 |
|
71 | 81 | --- |
72 | 82 |
|
73 | | -## 📤 Outputs & Evidence Handling |
| 83 | +## ⚙️ Requirements & Environment |
| 84 | + |
| 85 | +[]() |
| 86 | +[]() |
| 87 | +[]() |
74 | 88 |
|
75 | | -[]() |
76 | | -[]() |
77 | | -[]() |
| 89 | +- **PowerShell** |
| 90 | + Minimum **5.1** (PowerShell 7+ supported) |
78 | 91 |
|
79 | | -Most tools generate: |
| 92 | +```powershell |
| 93 | +$PSVersionTable.PSVersion |
| 94 | +``` |
| 95 | + |
| 96 | +- **Administrative Privileges** |
| 97 | + Required to access protected system artifacts. |
| 98 | + |
| 99 | +- **RSAT (when applicable)** |
| 100 | + |
| 101 | +```powershell |
| 102 | +Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online |
| 103 | +``` |
| 104 | + |
| 105 | +- **Execution Policy (session-scoped)** |
| 106 | + |
| 107 | +```powershell |
| 108 | +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process |
| 109 | +``` |
80 | 110 |
|
81 | | -- `.log` execution logs |
82 | | -- `.csv` structured datasets |
83 | | -- Timestamped artifacts |
84 | | -- Reproducible outputs suitable for audits and investigations |
| 111 | +- **Optional Modules** |
| 112 | + `ActiveDirectory`, `Defender`, `DHCPServer` |
85 | 113 |
|
86 | 114 | --- |
87 | 115 |
|
88 | | -## 🏛️ Governance & Forensic Principles |
| 116 | +## 🚀 Getting Started |
89 | 117 |
|
90 | | -[]() |
91 | | -[]() |
92 | | -[]() |
| 118 | +[]() |
| 119 | +[]() |
93 | 120 |
|
94 | | -- Non-destructive data handling |
95 | | -- Minimal system interaction |
96 | | -- Explicit logging of all actions |
97 | | -- Deterministic execution paths |
| 121 | +```powershell |
| 122 | +git clone https://github.com/brazilianscriptguy/Windows-SysAdmin-ProSuite.git |
| 123 | +cd Windows-SysAdmin-ProSuite/BlueTeam-Tools |
| 124 | +``` |
| 125 | + |
| 126 | +**Recommended workflow:** |
| 127 | + |
| 128 | +1. Select the appropriate category |
| 129 | +2. Review the local `README.md` |
| 130 | +3. Execute the script |
| 131 | +4. Review generated `.log` and `.csv` artifacts |
| 132 | + |
| 133 | +> ⚠️ Always validate execution context before running in production or investigative environments. |
98 | 134 |
|
99 | 135 | --- |
100 | 136 |
|
101 | | -## ⚙️ Requirements |
| 137 | +## 🔗 Integration & Interoperability |
102 | 138 |
|
103 | | -[]() |
104 | | -[]() |
105 | | -[]() |
| 139 | +[]() |
| 140 | +[]() |
| 141 | +[]() |
| 142 | + |
| 143 | +BlueTeam tools are designed to integrate with: |
| 144 | + |
| 145 | +- Incident response playbooks |
| 146 | +- GPO-based execution models |
| 147 | +- Scheduled forensic snapshots |
| 148 | +- SIEM ingestion pipelines |
| 149 | +- Compliance and audit evidence chains |
106 | 150 |
|
107 | 151 | --- |
108 | 152 |
|
109 | | -## 📬 Contact & Support |
| 153 | +## 🤝 Support & Community |
110 | 154 |
|
111 | | -[](mailto:[email protected]) |
112 | | -[](https://buymeacoffee.com/brazilianscriptguy) |
113 | | -[](https://ko-fi.com/brazilianscriptguy) |
114 | | -[](https://www.patreon.com/brazilianscriptguy) |
| 155 | +[](mailto:[email protected]) |
| 156 | +[](https://patreon.com/brazilianscriptguy) |
| 157 | +[](https://buymeacoffee.com/brazilianscriptguy) |
| 158 | +[](https://ko-fi.com/brazilianscriptguy) |
| 159 | +[](https://gofundme.com/f/brazilianscriptguy) |
115 | 160 |
|
116 | 161 | --- |
117 | 162 |
|
118 | | -© 2026 Luiz Hamilton Silva — BlueTeam-Tools |
| 163 | +> 🛡️ _BlueTeam-Tools Suite is engineered for environments where **forensics, response, governance, and auditability converge**._ |
| 164 | +
|
| 165 | +© 2026 Luiz Hamilton Silva. All rights reserved. |
0 commit comments