# Default Blue Strategy

Use this for general defensive security tasks when no specific strategy matches.

## Phase 1: Scope Assessment (budget: 20%)
1. Identify the defensive objective: detection, hardening, audit, or response
2. Determine assets in scope: hosts, networks, applications, cloud resources
3. Assess current security posture: existing controls, monitoring coverage, known gaps
4. Identify applicable frameworks: CIS Controls, NIST 800-53, MITRE ATT&CK

## Phase 2: Analysis (budget: 40%)
1. Review security configurations against benchmarks (CIS, STIG)
2. Analyze log coverage: what's collected, what's missing
3. Map detection coverage to ATT&CK techniques
4. Identify highest-risk gaps based on threat model

## Phase 3: Remediation (budget: 30%)
1. Prioritize by risk: likelihood × impact
2. Implement quick wins first (configuration changes, enable logging)
3. Write detection rules for identified gaps
4. Document compensating controls for items that can't be fixed immediately

## Phase 4: Verification (budget: 10%)
1. Validate changes: re-run audit, test detections
2. Document: what was changed, evidence of improvement, remaining gaps
