I imagine it has plenty of use cases for blue team as well, just not as many for active threat response.