BTFM: Blue Team Field Manual Book 1

by Ben Clark & Alan J. White

The Blue Team Field Manual is the defensive counterpart to RTFM, providing quick-reference commands and procedures for incident response, forensics, and network defense. Ben Clark and Alan White organize the manual by defensive function: log analysis, network monitoring, host-based forensics, malware analysis, and incident response procedures. Each section provides the specific commands needed to investigate suspicious activity on Windows and Linux systems, collect forensic artifacts, analyze network traffic, and contain active threats. The manual covers Windows Event Log queries, Linux audit commands, memory forensics procedures, network packet analysis syntax, and SIEM query patterns. Like RTFM, it prioritizes brevity and accuracy over explanation, making it a tool for practitioners who understand the concepts but need quick access to the right command.