Detect and stop the same behaviors studied in the red-team curriculum.
logs, alerts and signatures
analyze network alerts
find suspicious activity
isolate affected systems
restore and harden systems