\cleardoublepage \part{The Craft} \setbookpart{The Craft}

Part II: The Craft

The five functions of the blue team are one loop: intelligence and exposure shape what is detected, detections produce alerts, alerts become cases, cases lead to response, and every incident and exercise changes the detections. This part follows that loop and shows, function by function, what AI changes in the daily work, what stays with people and what the records look like.

Chapters in this part:

Chapter 5, Anticipate: Threat Intelligence and Exposure at Machine Speed, treats B1 Anticipate: intelligence as code, exposure feeds and the hypotheses that direct the team.
Chapter 6, Detect: Detection Engineering as Code, treats B2 Detect: detections as versioned, tested records.
Chapter 7, Triage Transformed: From Alert Queue to Verified Case, treats the work that defined tier 1 and stages the debate on whether AI should close alerts.
Chapter 8, Investigate: Hypotheses, Timelines and Evidence with AI, treats B3 Investigate: scoping, timelines and forensics with reproducibility.
Chapter 9, Threat Hunting Transformed: Hypotheses, Data and Agents, treats the hunt that finds what detections missed.
Chapter 10, Respond: Playbooks, Bounded Containment and the Stop Path, treats B4 Respond, where the series' rule on autonomy bites hardest.
Chapter 11, Learn: Post-Incident Review, Purple Teaming and Detection Debt, treats B5 Learn: the finding-to-verified-control path.

Blue team functions in this part. Each chapter names the functions it concerns, by their exact names. Together they cover B1 to B5.

The thread from the series. The technical designs of detection engineering, the AI-assisted SOC and incident management are those of AI Red Team, Chapters 18 to 21 and 26. This part takes them as given and describes the work.

What you will learn in this part:

How each function changes when AI takes part
Which records carry the work: detection, case, playbook, hunt and post-incident review
Where the line between assistance and delegation falls in each function
Which parts of the craft people must keep

Part III turns to the team's own AI: how analysts use it, how an agent team is governed, how its conclusions are verified and how it is defended.