AI Blue - Book Structure

This document describes the logical structure of AI Blue, Book 8 of The Architecture as Code Series. The book is organised into six parts with 28 numbered chapters, moving from the blue team in question through each function of its craft, the team's own AI, the team in the organisation and the people who do the work, to experience and conclusions, followed by the appendices.

Table of contents

Part I: The Blue Team in Question (Chapters 1–4)

Before the transformation, the pressure, and the transformed team defined (defines B1 Anticipate to B5 Learn)

Part II: The Craft (Chapters 5–11)

The craft function by function: anticipate, detect, triage, investigate, hunt, respond and learn

Part III: The Blue Team's AI Team (Chapters 12–15)

The team's own AI: analysts' assistants, agent teams, verification and defence of the SOC's AI

Part IV: The Team in the Organisation (Chapters 16–20)

The team in the organisation: operating models, roles, decision rights, regulation and measurement

Part V: People and Career (Chapters 21–24)

People and career: the analyst at work, competence, keeping the craft and the future of the team

Part VI: Experience and Conclusions (Chapters 25–28)

Cases, a year on the blue team, conclusions for two organisations and the verdict

Appendices and Reference

Glossary, Appendix A (code examples: detection, case, playbook and mandate artefacts), Appendix B (templates and tools), references and about the author

Chapter structure

Part I: The Blue Team in Question

The part is introduced by part_i_the_blue_team_in_question.md.

Chapter	File	Title	Description
1	01_introduction.md	Introduction: The Blue Team Transformed	Introduce the book on its own terms
2	02_what_the_blue_team_does.md	What the Blue Team Does: Five Functions, Tiers and the Alert Queue	Describe the blue team before the transformation, as the frame for everything later: what its five functions are, how a SOC is organised in tiers around a queue, which tools carry the work (SIEM, EDR, SOAR, ticketing, threat-intelligence platforms), who the neighbours are (IT operations, the CISO, the privacy officer, the business) and how the work is measured today
3	03_the_pressure_on_the_blue_team.md	The Pressure on the Blue Team: Machine-Speed Adversaries, Alert Volume and Scarce Talent	Describe the pressure that makes the transformation unavoidable rather than optional: adversaries that use AI to shorten the time from disclosure to exploitation, to scale social engineering and to automate parts of intrusion; telemetry volumes and alert counts that exceed human capacity; and a market in which skilled analysts are scarce
4	04_the_transformed_blue_team_defined.md	The Transformed Blue Team Defined: Mandate, Functions and Degrees of Delegation	Define the transformed blue team: its mandate, its five functions, the degrees of delegation per function and the accountability that does not move

Part II: The Craft

The part is introduced by part_ii_the_craft.md.

Chapter	File	Title	Description
5	05_anticipate.md	Anticipate: Threat Intelligence and Exposure at Machine Speed	Describe B1 Anticipate as transformed: threat intelligence, exposure awareness and hypothesis generation, where AI reads reports, extracts indicators and techniques, correlates them with the estate and drafts candidate hypotheses, and where the analyst's job becomes deciding which of them matter
6	06_detection_engineering_as_code.md	Detect: Detection Engineering as Code	Describe B2 Detect as transformed: the move from supplier-default rules and hand-tuned alerts to detection engineering as code, where each detection is a versioned record with logic, data sources, ATT&CK mapping, test cases, an owner and a review date, and where AI drafts candidate detections from reports and incidents under review
7	07_triage_transformed.md	Triage Transformed: From Alert Queue to Verified Case	Describe triage as transformed: the work that defined tier 1, deciding whether an alert is real and how bad it is, is now increasingly done by AI that enriches, correlates, summarises and in places closes alerts
8	08_investigation_and_forensics.md	Investigate: Hypotheses, Timelines and Evidence with AI	Describe B3 Investigate as transformed: scoping, timeline reconstruction, log and endpoint analysis and forensics, where AI queries data lakes, assembles timelines, proposes hypotheses and drafts the case narrative, and where the investigator's work becomes steering, challenging and verifying
9	09_threat_hunting_transformed.md	Threat Hunting Transformed: Hypotheses, Data and Agents	Describe threat hunting as transformed: the hypothesis-driven search for intruders that detections missed, now with AI that proposes hypotheses, writes and runs queries, and clusters anomalies, and where the hunter's judgement is deciding which hypotheses are worth the data
10	10_response_transformed.md	Respond: Playbooks, Bounded Containment and the Stop Path	Describe B4 Respond as transformed: containment, eradication, recovery coordination, communication and reporting, where the response is increasingly codified as playbooks and parts of it run at machine speed
11	11_the_learning_loop.md	Learn: Post-Incident Review, Purple Teaming and Detection Debt	Describe B5 Learn as transformed: the post-incident review, the purple loop and the maintenance of detections, playbooks and mandates, where AI drafts reviews, proposes improvements and tracks closure, and where the blameless, evidence-based discipline of review is at risk of becoming a generated formality

Part III: The Blue Team's AI Team

The part is introduced by part_iii_the_blue_teams_ai_team.md.

Chapter	File	Title	Description
12	12_the_analysts_own_use_of_ai.md	The Analyst's Own Use of AI: Querying, Drafting and Summarising in Modes 1 to 3	Describe the analyst's own use of AI in Modes 1 to 3: querying, drafting and summarising, and the discipline needed to use assistants safely when the data is sensitive
13	13_an_ai_agent_team_for_the_soc.md	An AI Agent Team for the SOC: Skills, Mandates and Containment	Describe the AI agent team of the SOC: triage, enrichment, investigation, detection-drafting and response agents, each with its own mandate manifest, identity, tools, data and autonomy level, and a human conductor
14	14_verifying_what_the_ai_concludes.md	Verifying What the AI Concludes: Review for Soundness When the Analyst Depends on the AI	Describe how an analyst verifies what AI concludes when the analyst depends on the AI to read the data at all
15	15_defending_the_defenders_ai.md	Defending the Defenders' AI: Poisoned Telemetry, Hostile Tickets and the SOC as Tier 0	Describe the defence of the defenders' AI: the SOC reads text that adversaries can write, in logs, tickets, emails, filenames and threat reports, so its agents are privileged insiders that can be manipulated, and its platform is a tier-0 asset

Part IV: The Team in the Organisation

The part is introduced by part_iv_the_team_in_the_organisation.md.

Chapter	File	Title	Description
16	16_operating_models.md	Operating Models: In-House, Managed, Hybrid and Sovereign Security Operations	Describe the operating models available to a European organisation: in-house SOC, managed detection and response (MDR), managed security service provider (MSSP), hybrid and sovereign variants, and how AI changes the choice
17	17_team_design_and_roles.md	Team Design and Roles: After the Tier-1 Pyramid	Describe team design and roles after the tier-1 pyramid: what happens when triage is largely automated and the entry rung of the career ladder shrinks
18	18_decision_rights_and_escalation.md	Decision Rights and Escalation: Who May Contain, Isolate and Disclose	Describe decision rights and escalation for the transformed team: who may isolate a production system, disable an account, take a citizen-facing service offline, disclose an incident to a regulator or to affected people, pay or refuse a ransom, and stop an agent
19	19_regulation_as_constraint.md	Regulation as Constraint: NIS 2, DORA, CRA, GDPR, the AI Act and the Reporting Clock	Describe regulation as a constraint on the blue team's design: NIS 2 (Articles 20, 21 and 23), Commission Implementing Regulation (EU) 2024/2690, DORA (Articles 5 and 17 to 19 and the register of information), the Cyber Resilience Act's reporting duty for actively exploited vulnerabilities, the GDPR (Articles 5, 32, 33 and 34), the AI Act (Articles 3, 14, 26 and 73) and the Cyber Solidarity Act, together with national transposition
20	20_measuring_the_transformed_blue_team.md	Measuring the Transformed Blue Team: Speed, Coverage and Quality of Judgement	Describe how to measure the transformed blue team without rewarding the wrong thing

Part V: People and Career

The part is introduced by part_v_people_and_career.md.

Chapter	File	Title	Description
21	21_the_analyst_at_work.md	The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics	Describe the analyst at work: alert fatigue, on-call, the stress of incident work and the experience of working beside agents, and the fact that the analyst is themselves managed by metrics and monitored by the tools they use
22	22_competences_training_and_exercises.md	Competences, Training and Exercises: A Framework for the Transformed Blue Team	Define competences for the transformed blue team and how they are built and evidenced: detection engineering, investigation, hunting, incident command, working with agents (mandates, review, containment), data and query skills, legal and regulatory literacy and communication
23	23_keeping_the_craft_and_making_new_analysts.md	Keeping the Craft and Making New Analysts: The Apprenticeship Problem	Describe the apprenticeship problem: if AI does the junior triage through which analysts learned their craft, where do the next experts come from, and how do experts keep their own skill? Apply the evidence of AI Threat, Chapter 14, and the craft-keeping design of The Transformed Security Architect, Chapter 15, to the SOC: unassisted practice, seeded incidents, rotation between engineering and operations, structured shadowing, apprenticeship routes and the policy of keeping a share of cases unassisted
24	24_the_future_of_the_blue_team.md	The Future of the Blue Team: Will There Be a SOC in 2036?	Look ahead with the series' discipline: will there be a SOC in 2036? Treat the future of the blue team as a horizon register in which each trend is labelled observable, expected or speculation, and the author's own projection is confined to this chapter and Chapter 28

Part VI: Experience and Conclusions

The part is introduced by part_vi_experience_and_conclusions.md.

Chapter	File	Title	Description
25	25_case_studies_and_anti_patterns.md	Case Studies and Anti-Patterns	Collect case studies and anti-patterns of the transformed blue team, in the series' form: what happened, what failed, what the pattern is and what the control would have been
26	26_a_year_on_the_blue_team.md	A Year on the Blue Team: Nordvik Region and Hansa Mutual	Follow four people in the two organisations through a year on the blue team (2027): Karin Lund, senior security analyst and de facto detection owner at Nordvik Region; Piotr Nowak, shift lead at Hansa Mutual's Polish service centre SOC; Lena Vogel, detection engineering lead in Hamburg; and Thomas Brandt, chair of Hansa Mutual's Konzernbetriebsrat
27	27_conclusions_for_nordvik_and_hansa.md	Nordvik Region and Hansa Mutual: Conclusions for Two Organisations	Draw the chapters together into a conclusion for each organisation: what Nordvik Region and Hansa Mutual should do in the next two years for each of the five functions, what they should stop, and what each should decide at the management-body level
28	28_conclusion.md	Conclusions: The Blue Team Transformed	State the book's conclusions: what the evidence supports about the transformed blue team, which parts of the thesis hold, which are not proved and what would change the view

Appendices and Reference

The appendices are introduced by part_appendices.md.

Item	File	Title	Description
Glossary	29_glossary.md	Glossary	Defines the vocabulary of the book.
Appendix A	30_appendix_a_code_examples.md	Appendix A: Code Examples: Detection, Case, Playbook and Mandate Artefacts	Fuller versions of the artefacts introduced in the chapters.
Appendix B	appendix_templates_and_tools.md	Appendix B: Templates and Tools	A directory of the templates and tools the chapters provide, with the chapter that introduces each.
References	31_references.md	References and Sources	Canonical bibliography
About the Author	32_about_the_author.md	About the Author	Background and perspective

Companion files

File	Purpose
BOOK_BLUEPRINT.md	Premise, thesis, audience, the brief of every chapter, the foundations it builds on, the blue team functions it concerns and its status
SERIES_FOUNDATIONS.md	The conclusions of Books 1–7 that this book builds on, with the tables of contents of the earlier volumes for cross-references
EXAMPLE_ORGANISATIONS.md	Canonical profiles of Nordvik Region and Hansa Mutual, including their blue team profiles
CHAPTER_AUTHORING_GUIDE.md, STYLE_GUIDE.md, AUTHOR_PERSONA.md	Rules for structure, language and voice

Canonical ordering

scripts/toc_definition.py holds the table of contents and regenerates docs/book_index.json, the mkdocs.yml navigation and the chapter list in BOOK_REQUIREMENTS.md. docs/book_index.json and mkdocs.yml must agree (tests/test_book_index.py).