Purple Team

Fix detection gaps while we attack.

Announced, facilitated technique runs with your analysts watching. You see each technique land and tune detections between runs.

From technique to detection.

Five steps, repeated with your analysts watching each run.

  1. Pick the tactics

    We agree the ATT&CK tactics and techniques for each facilitated run.

  2. Execute in the open

    Each technique runs while your analysts watch the telemetry live.

  3. Check the outcome

    Each technique is scored on whether it logged, alerted or blocked, and the heat map fills in.

  4. Tune between runs

    Rules are adjusted with your team and the technique runs again.

  5. Leave a replay plan

    You keep the gap list, the rule suggestions and a plan to replay it all.

What this engagement covers

When you need it

  • After a red team
  • After SIEM or EDR changes
  • On a cadence you choose

What we do

  • Execute techniques by ATT&CK tactic
  • Check log, alert and block outcomes
  • Tune rules between runs

What you get

  • A coverage heat map
  • A gap list by stage
  • Detection rule suggestions
  • A replay plan

How it runs

  • Duration: Validate operations run longer than an Assess engagement and are quoted per objective.
  • What we need from you: Your analysts watching each run and the access to tune SIEM or EDR rules between runs.

Standards

  • MITRE ATT&CK
  • NIST CSF Detect

Frequently Asked Questions

Is the exercise announced?
Yes. Runs are announced and facilitated, with your analysts watching each technique land.
What happens between runs?
You tune detection rules, with our suggestions, and the replay plan re-runs the techniques to check the log, alert and block outcomes changed.
How often should we run it?
On a cadence you choose. Common triggers are after a red team and after SIEM or EDR changes.

How We Work

Eight steps from the first call to the closure letter. Every engagement follows them.

  1. Scoping call
  2. Rules of engagement
  3. Threat model
  4. Execution
  5. Analysis
  6. Readout
  7. Remediation support
  8. Retest
Read the full lifecycle

Ready to scope an engagement?

Tell us the asset and the decision the test should inform.

Scope a call