Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.
Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.
SOC teams need to validate that detection rules actually fire for the threats they target
Red team assessments produced findings that need translation into detection improvements
New detection tools or SIEM migrations require validation of detection coverage
Analyst training requires hands-on experience with real attack techniques and SIEM responses
Quarterly or semi-annual detection validation cycles are scheduled
Do not use for unannounced red team engagements — purple team exercises require explicit coordination between offensive and defensive teams with real-time collaboration.
Prerequisites
Red team capability: internal team or contracted purple team operator
Attack simulation tools: Atomic Red Team, MITRE Caldera, or C2 framework (authorized)
SIEM access for real-time alert monitoring during exercise
ATT&CK-mapped detection rule inventory with expected alert names
Isolated test environment or approved production scope with change management approval
Communication channel (Slack/Teams) for real-time red-blue coordination
For each gap, the blue team builds detection rules immediately:
--- Gap: T1003.001 — No LSASS access detection
--- Build rule during exercise
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x40")
NOT SourceImage IN ("*\\svchost.exe", "*\\csrss.exe", "*\\MsMpEng.exe")
| stats count by Computer, SourceImage, SourceUser, GrantedAccess
| where count > 0
After building, re-test:
Red Team: "Re-executing T1003.001 at 11:45"
Blue Team: "Confirmed — alert 'LSASS Memory Access Detected' fired at 11:45:32 (32s latency)"
Result: GAP CLOSED
Step 6: Generate Exercise Report
defgenerate_purple_team_report(results):
total = len(results["results"])
detected = sum(1for r in results["results"] if r["detected"])
gaps = sum(1for r in results["results"] ifnot r["detected"])
avg_latency = sum(r["latency_seconds"] for r in results["results"]
if r["latency_seconds"]) / max(detected, 1)
report = f"""
PURPLE TEAM EXERCISE REPORT — {results['exercise_id']}{'=' * 60}
SUMMARY:
Techniques Tested: {total}
Detected: {detected} ({detected/total*100:.0f}%)
Gaps Identified: {gaps} ({gaps/total*100:.0f}%)
Avg Detection Latency: {avg_latency:.0f} seconds
DETAILED RESULTS:
"""for r in results["results"]:
status = "DETECTED"if r["detected"] else"GAP"
latency = f"{r['latency_seconds']}s"if r["latency_seconds"] else"N/A"
report += f" [{status}] {r['technique']} — {r['name']} (Latency: {latency})\n"ifnot r["detected"]:
report += f" Action: {r['notes']}\n"return report
Key Concepts
Term
Definition
Purple Team
Collaborative exercise where red (offensive) and blue (defensive) teams work together to validate and improve detection
Adversary Emulation
Structured simulation of specific threat actor TTPs for testing defensive capabilities
Detection Validation
Process of confirming that detection rules fire correctly when the targeted technique is executed
Detection Latency
Time between technique execution and SIEM alert generation — measured during purple team exercises
Gap Remediation
Immediate creation or tuning of detection rules for techniques that were not detected during testing
Atomic Red Team
Open-source library of small, focused tests for individual ATT&CK techniques
Tools & Systems
Atomic Red Team: Open-source attack test library from Red Canary for technique-by-technique validation
