ConsultationPurple Team
Offense-defense collaboration to rapidly improve detection.
Overview
Purple Team executes agreed techniques while measuring detection so the gap between offense and defense closes in days, not months.
Output converts directly into SIEM rules, endpoint controls, and analyst training.
Audience
Organizations seeking short feedback loops.
Deliverables
- ATT&CK coverage matrix
- Detection gap list
- 30-day improvement plan
Process
- 01Technique selection
- 02Joint execution
- 03Detection measurement
- 04Tuning
Outcomes
- Rapidly closed detection gaps
- Shared language between Red and Blue
- Provable ATT&CK coverage improvement