Cybersecurity
Purple teaming
In a purple team exercise, the people simulating the attack and the people watching for it work together. We run a technique, check whether it was detected, and fix the detection before moving on.
The problem this service solves
Many detection rules have never been tested against the behavior they are meant to catch. Teams find out during a real incident, or never. A purple team exercise shortens that loop to hours. An operator runs a technique, an analyst looks for the signal, and the two decide whether it is good enough.
The exercise ends with working detections, not only a report. It is also one of the fastest ways to train analysts, because they see attacker behavior alongside their own telemetry.
What is in scope
-
Technique selection
Choose ATT&CK techniques based on relevance to your industry and gaps in coverage.
-
Simulation
Run each technique safely against agreed hosts or accounts.
-
Detection check
See whether the telemetry exists, whether a rule fires, and whether an analyst could tell what happened.
-
Tuning and creation
Fix log collection, write or adjust rules, and re-run until the behavior is detected with acceptable noise.
-
Documentation
Record the technique, the detection logic, its limits and the response steps.
How the work runs
Prepare
Choose what to test.
-
1
Coverage review
Map existing detections to ATT&CK and identify weak areas.
-
2
Exercise plan
Select techniques, define the success criteria and agree the safety limits.
Run
Test, fix, test again.
-
3
Execute technique
Operator runs the technique and shares exactly what was done.
-
4
Observe
Analyst searches for the signal and says what they see or do not see.
-
5
Improve
Together: change collection, write a rule, adjust thresholds, re-run.
Close
Leave the detections working.
-
6
Detection catalog
Deliver the new rules, tests and runbooks in your platform’s format.
-
7
Next-cycle plan
Recommend the next set of techniques, in priority order.
What you receive
- ATT&CK coverage map before and after
- New and tuned detection rules, delivered in your platform format
- Per-technique write-up: what was run, what was seen, what changed
- Analyst response notes
- Recommended next exercises
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Detection engineers or SOC analysts available during the sessions
- Access to the SIEM and EDR consoles
- A test environment or approved systems to run techniques on
- A list of the threat behaviors you care about most
What this service is not
- A surprise test of your defenders (see red teaming)
- A tool bake-off
- A replacement for ongoing detection engineering
What changes afterwards
- Detections have been tested against the behavior they target
- Analysts have seen what each technique looks like in your telemetry
- You have a repeatable way to test new detections
Questions people ask
How long does a purple team engagement take?
Scoped by the number of techniques. A focused exercise can run in days. Many teams repeat shorter cycles quarterly.
Do we need a SIEM first?
You need some logging and a place to search it. If you do not have either, we recommend SIEM or logging work before the exercise.
Related
-
Detection engineering
Design, write, test and maintain detections tied to specific attacker behaviors, with false-positive control and documented response steps.
-
SIEM consulting
Architecture, data onboarding, cost control and migration for Microsoft Sentinel, Splunk, Elastic and Google Security Operations.
-
Red teaming
Objective-based adversary simulation that tests people, process and technology together against a realistic attacker over several weeks.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response