CAPABILITY MATRIX / OPERATOR

SKILL

A matrix of technical capabilities and tools.

PROFILE BLUE_TEAM // TOOLS 007+

CAPABILITY_01 // 92%

Log Analysis & Alert Triage

SIEM workflow, indicators, context building and prioritization.

CAPABILITY_02 // 86%

Triage, containment, artifact handling and timeline thinking.

CAPABILITY_03 // 88%

Traffic analysis, protocols, filtering and packet-level reasoning.

CAPABILITY_04 // 82%

Acquisition workflow, integrity checks and forensic copies.

CAPABILITY_05 // 84%

Process, network, injected code and volatile artifact analysis.

CAPABILITY_06 // 79%

Signature-based recovery, validation and artifact reconstruction.

CAPABILITY_07 // 78%

Static and dynamic reasoning around suspicious binaries.

CAPABILITY_08 // 84%

Windows and Linux internals for investigation workflows.