purple-team

• SKILL.mdcore · 6,672 bytes
• SKILL.mdcore · 6,672 bytes
• SKILL.mdcore · 6,672 bytes
• SKILL.mdcore · 6,672 bytes

## Overview

Purple team is not a third team — it is a **collaboration model**: red (offense) and blue (defense) working together in the open to test whether specific adversary techniques are detected, and fixing the gaps on the spot. Instead of a stealthy red-team op followed by a painful debrief, purple exercises are transparent, iterative, and fast: execute a technique, check the telemetry, tune the detection, repeat.

This skill covers planning and running purple-team exercises that measurably improve detection coverage per MITRE ATT&CK technique.

Purple-team exercises are the fastest known way to convert 'we think we are covered' into 'we proved we are covered' — the tight execute-observe-tune loop compresses months of detection-engineering guesswork into an afternoon. The cultural effect matters too: red and blue building together replaces the adversarial blame dynamic with shared ownership of detection quality.

## When to use

- Validating detection coverage for high-priority techniques (credential access, lateral movement, exfiltration).
- After deploying a new EDR/SIEM/log source — prove it actually detects what you bought it for.
- Building a detection backlog grounded in tested reality instead of assumptions.
- Training junior analysts and detection engineers on adversary behavior hands-on.