Purple Teaming

# Purple team - defender perspective

> Authorised work only. Purple-team exercises are scheduled, cooperative
> engagements between offensive and defensive teams aimed at measurably
> improving detections, runbooks, and culture.

## What a purple team really is

- Not a separate team - a collaboration mode between red and blue
- Cooperative: red announces what they are about to do, blue watches
- Iterative: run a TTP, see if detection fires, tune, re-run

## Why it works

- Closes the gap between 'we have a detection' and 'the detection actually fires under realistic conditions'
- Builds shared mental model of attacker behaviour
- Creates a measurable artefact: detection coverage of ATT&CK techniques
- Beats 'gotcha' red teams as a teaching tool

## A simple cadence

1. Pick 5-10 techniques from ATT&CK that matter for your environment
2. Map each to existing detections (or gaps)
3. Red runs the technique in a lab or production-mirroring env
4. Blue watches: which alerts fire, in what order, with what context
5. Tune: write a new detection or improve an existing one
6. Re-run; confirm the detection fires reliably; document
7. Add to your purple-team artefact (a coverage matrix)

## Tools

- MITRE ATT&CK navigator for coverage tracking
- Atomic Red Team for repeatable, scripted TTPs
- Caldera or VECTR for managed exercises
- Detection-as-code repos: Sigma rules, Splunk searches, KQL queries

## Roles + cadence

- Detection engineer drives blue side
- Red lead drives offensive side; they may be internal or contracted
- Quarterly cadence is healthy; monthly during onboarding
- Out-brief includes the coverage matrix + tuning list + culture observations

## Anti-patterns

- Red 'wins' culture - misses the point
- No follow-up tuning - the exercise teaches nothing if rules do not change
- Production-only testing - dangerous; mirror env first

## Outcomes you should expect

- Documented ATT&CK coverage matrix
- A short list of new or improved detections
- Clearer runbook for the techniques you tested
- Improved trust between offensive and defensive teams

# Purple team = red + blue collaborating in real time.
# You announce TTPs as you run them; blue tunes detections; rerun until covered.
# Highest ROI form of offensive testing for a mature org.