Generally, the best practice to improve the “blue” team is to work hand-in-hand with the “red” team. This turns into a “purple” teaming engagement, where the red team runs common attack scenarios, such as malware uploads, file extractions, network attacks, and further-more with the goal of improving blue team base-lining and detection capabilities.
All testing performed is based on the NIST SP 800-115 Technical Guide to Information Security Testing and Assessment, OWASP Testing Guide (v4), OWASP Top 100 Scenerios, and customized testing frameworks.