<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: purple-team
description: >-
  Purple team exercises, adversary emulation, and detection validation using
  CALDERA, Atomic Red Team, ATT&CK Navigator, PurplePanda, and CloudGoat.
  Use when asked about detection coverage mapping, gap analysis, emulation
  planning, control validation, detection engineering bridging red and blue
  findings, or joint red/blue exercises.
domain: cybersecurity
subdomain: purple-team
tags:
  - purple-team
  - adversary-emulation
  - caldera
  - atomic-red-team
  - mitre-attack
  - detection-engineering
  - coverage-mapping
  - cloudgoat
  - purplepanda
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1003", "T1059", "T1021", "T1053", "T1055", "T1078", "T1566"]
  nist-csf: ["DE.AE-2", "DE.AE-3", "DE.CM-1", "DE.CM-7", "DE.DP-4"]
---

# Purple Team / Adversary Emulation

## When to Use

- Planning and executing purple team exercises
- CALDERA adversary profile creation and operation management
- Atomic Red Team test execution and custom atomic design
- ATT&CK Navigator coverage mapping and gap analysis
- Detection validation (MTTD measurement, pass/fail per technique)
- Cloud emulation with CloudGoat scenarios
- PurplePanda cloud/SaaS privilege enumeration with Neo4j

## Prerequisites

- CALDERA server (Python 3.8+ or Docker) with Sandcat agent access
- Atomic Red Team (PowerShell module or bash atomics)
- ATT&CK Navigator (web UI or local) for coverage layers
- CloudGoat (Python 3.6+, Terraform, AWS test account) for cloud exercises
- PurplePanda with Neo4j for cloud privilege graph analysis
- Sigma CLI for rule creation and conversion

## Quick Reference

| Task | Command |
|------|---------|
| CALDERA start | `python3 server.py --insecure --build` → http://localhost:8888 |
| CALDERA REST operation | `POST /api/v2/operations` with adversary_id, planner, group |
| Atomic run | `Invoke-AtomicTest T1003.001 -GetPrereqs && Invoke-AtomicTest T1003.001` |
| Atomic cleanup | `Invoke-AtomicTest T1003.001 -Cleanup` |
| CloudGoat deploy | `./cloudgoat.py create iam_privesc_by_rollback` |
| CloudGoat destroy | `./cloudgoat.py destroy iam_privesc_by_rollback` |
| PurplePanda enum | `python3 main.py -e -p google,k8s --k8s-get-secret-values` |
| PurplePanda privesc | `MATCH(p)-[r:PRIVESC]->(res) RETURN p,r,res` |
| Navigator layer | JSON with techniqueID, score (0-100), comment per technique |

## Workflow

### 1. Pre-Exercise: Coverage Baseline

1. Export current detection rules mapped to ATT&CK technique IDs
2. Generate ATT&CK Navigator layer (green=covered, grey=gap)
3. Identify top 10 gap techniques prioritized by threat actor relevance
4. Build CALDERA adversary profile targeting gap techniques

Read `references/coverage-mapping.md` for Navigator JSON format, gap analysis tables, and coverage-per-tactic templates.

### 2. Emulation Execution

1. Deploy CALDERA Sandcat agent on test hosts in isolated VLAN
2. Run CALDERA operation (atomic planner) — red monitors operation chain
3. Blue team watches SIEM/EDR in real-time with joint comms channel
4. For each technique: record T_exec, check T_alert → calculate MTTD
5. Alternate: run individual Atomic Red Team tests for targeted technique validation

Read `references/emulation-tools.md` for CALDERA profiles, Atomic tests, CloudGoat scenarios, and PurplePanda queries.

### 3. Detection Gap Closure

1. Identify gap: technique executed, no alert fired
2. Check log source: did the event appear in SIEM?
   - No events → blind spot: enable log collection first
   - Events present → gap: write Sigma rule
3. Deploy rule, re-run atomic test, verify alert fires within 60 seconds
4. Monitor 1 week for false positives; tune if FP rate > 5%
5. Mark technique as "Covered" in Navigator layer

### 4. Debrief and Reporting

1. Overlay red team timeline vs. blue team detection timeline
2. For each technique: detected/not detected, MTTD, FP count
3. Calculate coverage delta (techniques moved from grey to green)
4. Produce gap analysis with prioritized Sigma rule recommendations
5. Schedule remediation sprint within 30 days

## Exercise Report Structure

```
Purple Team Exercise Report
Date / Scope / Threat Actor Emulated
Executive Summary: X of Y techniques detected (Z% detection rate)
MTTD: average Xmin for detected techniques

Technique Results Table:
| ATT&CK ID | Technique | Detected | MTTD | Rule | Gap/Recommendation |

Blind Spots: [no logging]
Coverage Gaps: [logging, no rule — with Sigma recommendations]
New Rules Deployed: [list]
Priority Remediation: [top 5 gaps by risk]
```

## Verification

- CALDERA operation completes with all abilities executed (check operation results API)
- Atomic tests return clean exit codes; cleanup removes artifacts
- Navigator layer shows measurable coverage delta (before vs. after)
- All new Sigma rules validated against re-executed atomic tests
- MTTD metrics recorded for each technique tested

## Detection Opportunities

Purple team exercises themselves generate artifacts:
- CALDERA C2 beaconing (HTTP POST to port 8888)
- Sandcat agent process creation and network connections
- Atomic Red Team PowerShell module loading and script block logging
- CloudGoat IAM operations visible in CloudTrail
