Blue Team | Intelligence-Driven Defense for the Real World

Blue Team | Intelligence-Driven Defense for the Real World

by Gilmar Esteves

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Gilmar Esteves 👥 70K 📅 February 17, 2026 ⏱ 37 min 👁 151 📄 expert opinion 🧭 2026-08-15
Available in: English (current) Français

Keywords

threat intelligenceblue teamincident responsetelemetryCTI pipeline

Summary

Gilmar Esteves, Head of Security Products at Apura, presents a practical framework for building and operationalizing threat intelligence (CTI) to support blue teams. He emphasizes that CTI is not just about collecting feeds or producing reports, but about turning external and internal data into actionable decisions. The talk covers the CTI pipeline: business requirements, data collection (internal telemetry and external feeds), enrichment, correlation, and prioritization. He highlights common pitfalls like alert fatigue, noise, and overengineering, and offers lessons learned from his experience, such as starting small with credential exposure monitoring, automating enrichment, and closing feedback loops. He stresses the importance of aligning CTI with business goals, measuring impact, and avoiding data overload. The presentation includes practical advice on architecture, data normalization, and governance, and concludes with the message that CTI should drive faster detection, fewer false positives, and higher confidence in response decisions.

143 words

Critical Evaluation

Value of the Information & Strength of the Argument

The talk provides valuable, practical insights from a seasoned CTI practitioner, emphasizing the importance of moving beyond data collection to actionable intelligence. The argumentation is coherent, structured around a clear pipeline and supported by real-world examples and lessons learned. The speaker effectively communicates the challenges of noise, alert fatigue, and the need for context, and offers actionable advice on starting small and iterating. However, the argumentation relies heavily on anecdotal evidence and personal experience, lacking empirical data or references to formal frameworks, which slightly weakens its scientific rigor.

Scientific Rigor, Source Quality, Title Accuracy

The presentation is based on the speaker’s extensive professional experience, but no specific sources, studies, or references are cited. The title accurately reflects the content, focusing on intelligence-driven defense for blue teams. The talk is more of an expert opinion and practical guidance than a rigorous scientific review, but it is well-structured and credible given the speaker’s background. The lack of formal citations is a limitation for verification, but the practical nature of the content compensates to some extent.

182 words

Title / Content Match

The title accurately reflects the content, focusing on intelligence-driven defense for blue teams in real-world scenarios.

Quality & Reliability

7/10

The speaker is a seasoned CTI practitioner with over a decade of experience, providing practical insights and lessons learned. However, the talk is largely anecdotal and lacks formal citations or references to specific studies or frameworks, which limits its verifiability.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Concurring Sources

  • SANS CTI Resources — General CTI guidance aligns with the talk's principles.

Contribution & Novelties

The talk offers a practical, experience-based framework for operationalizing threat intelligence, emphasizing the integration of external and internal data to drive blue team actions. It provides actionable advice on starting small, automating enrichment, and closing feedback loops, which is valuable for practitioners. The speaker’s emphasis on aligning CTI with business goals and measuring impact is a key takeaway.

Pour aller plus loin :

  • Cyber Threat Intelligence: A Review — Academic review of CTI concepts and challenges.
  • MITRE ATT&CK — Framework for adversary tactics and techniques, relevant to TTP analysis.
  • Diamond Model of Intrusion Analysis — Model for analyzing cyber threats, useful for correlation.

103 words

Radar Profile

The radar profile shows high scores in information quantity and quality, with moderate technical depth and reliability. This reflects a talk rich in practical advice and experience, but with limited formal rigor and technical detail.

Reliability 7/10

💬 No comments provided.