performing-purple-team-exercise

name	performing-purple-team-exercise
description	Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.
domain	cybersecurity
tags	["soc","purple-team","red-team","blue-team","mitre-attack","adversary-emulation","detection-validation"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Performing Purple Team Exercise

Overview

Cybersecurity skill for performing purple team exercise. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing purple team exercise"
• "SOC teams need to validate that detection rules actually fire for the threats th"
• "Red team assessments produced findings that need translation into detection impr"
• "New detection tools or SIEM migrations require validation of detection coverage"

Use this skill when:

• SOC teams need to validate that detection rules actually fire for the threats they target
• Red team assessments produced findings that need translation into detection improvements
• New detection tools or SIEM migrations require validation of detection coverage
• Analyst training requires hands-on experience with real attack techniques and SIEM responses
• Quarterly or semi-annual detection validation cycles are scheduled

Do not use for unannounced red team engagements — purple team exercises require explicit coordination between offensive and defensive teams with real-time collaboration.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Red team capability: internal team or contracted purple team operator
• Attack simulation tools: Atomic Red Team, MITRE Caldera, or C2 framework (authorized)
• SIEM access for real-time alert monitoring during exercise
• ATT&CK-mapped detection rule inventory with expected alert names
• Isolated test environment or approved production scope with change management approval
• Communication channel (Slack/Teams) for real-time red-blue coordination

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}