<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-purple-team-exercises
description: >-
  Plan, execute, and debrief joint red-blue purple team exercises. Covers
  exercise scoping, communication protocols, real-time collaboration, detection
  measurement, and after-action reporting with remediation tracking.
domain: cybersecurity
subdomain: purple-team
tags:
  - purple-team
  - exercises
  - red-team
  - blue-team
  - detection-engineering
  - collaboration
  - after-action-report
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Conducting Purple Team Exercises

## Overview

Purple team exercises bring red and blue teams together in real-time to execute
attack techniques, observe defensive response, and close detection gaps on the
spot. Unlike traditional red team engagements, purple exercises prioritize
collaborative learning and measurable detection improvement.

## Prerequisites

| Requirement | Install |
|---|---|
| CALDERA | Emulation platform for automated technique execution |
| Atomic Red Team | Granular technique tests for manual validation |
| Shared comms channel | Slack/Teams channel or shared war room |
| SIEM access | Blue team needs real-time query access |
| ATT&CK Navigator | Coverage layer visualization |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Exercise Phases

| Phase | Duration | Activities |
|---|---|---|
| Planning | 1–2 weeks | Scope, threat model, technique selection |
| Baseline | 1–2 days | Export current coverage, prepare Navigator layer |
| Execution | 1–5 days | Joint technique execution and detection |
| Gap closure | 1–2 days | Write rules for missed techniques |
| Debrief | Half day | After-action report, metrics, remediation plan |

### Communication Protocol

```
[RED]  "Executing T1003.001 — LSASS credential dump on HOST-01 at 14:30 UTC"
[BLUE] "Confirmed — Sysmon EID 10 alert fired at 14:30:42 UTC, rule sigma-cred-001"
[RED]  "Executing T1021.002 — lateral movement to HOST-02 at 14:35 UTC"
[BLUE] "MISS — no alert. Checking log availability..."
[BLUE] "Logs present in SIEM. Writing Sigma rule for SMB lateral movement."
```

### Scoring Framework

| Result | Score | Description |
|---|---|---|
| Detected + alerted | 3 | Alert fired, analyst notified |
| Logged + no rule | 2 | Telemetry present, no detection rule |
| Partial detection | 1 | Related alert but not specific to technique |
| No detection | 0 | Blind spot — no telemetry or rule |

## Workflow

### 1. Plan Exercise

```bash
# Generate exercise plan from threat actor profile
node scripts/agent.js plan-exercise \
  --threat-actor APT29 \
  --scope "initial-access,execution,credential-access,lateral-movement" \
  --duration 3 \
  --output exercise-plan.json
```

### 2. Establish Baseline

```bash
# Export current coverage
node scripts/agent.js export-baseline \
  --rules-dir rules/ \
  --output baseline-layer.json
```

### 3. Execute Techniques

```bash
# Track technique execution and detection in real-time
node scripts/agent.js execute-round \
  --plan exercise-plan.json \
  --round 1 \
  --technique T1003.001 \
  --target-host HOST-01 \
  --exec-time "2026-03-15T14:30:00Z"

# Record blue team response
node scripts/agent.js record-response \
  --round 1 \
  --technique T1003.001 \
  --detected true \
  --alert-time "2026-03-15T14:30:42Z" \
  --rule-id sigma-cred-001 \
  --score 3
```

### 4. Generate After-Action Report

```bash
# Compile exercise results
node scripts/agent.js generate-report \
  --plan exercise-plan.json \
  --output exercise-report.json
```

## Verification

| Check | Method |
|---|---|
| All techniques executed | Plan shows 100% execution completion |
| Responses recorded | Every technique has detection score |
| MTTD calculated | Average detection time for scored ≥ 1 techniques |
| Coverage delta | Navigator layer shows improvement over baseline |
| Report complete | After-action report has findings and remediation plan |

## References

- [MITRE ATT&CK Purple Team Guide](https://attack.mitre.org/)
- [SCYTHE Purple Team Exercise Framework](https://www.scythe.io/)
- [Atomic Purple Team](https://github.com/redcanaryco/atomic-red-team)
