<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-red-blue-debrief-sessions
description: >-
  Facilitate structured red-blue debrief sessions that translate purple team
  exercise findings into actionable improvements. Covers debrief frameworks,
  finding classification, timeline reconstruction, detection gap documentation,
  and remediation tracking across red team, blue team, and stakeholder audiences.
domain: cybersecurity
subdomain: purple-team
tags:
  - debrief
  - red-team
  - blue-team
  - purple-team
  - after-action-review
  - remediation-tracking
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Red-Blue Debrief Sessions

## Overview

Debrief sessions are where purple team exercises produce lasting value. Structured
debriefs reconstruct the attack timeline, document what was detected versus missed,
classify findings by severity, and produce tracked remediation items. Without
effective debriefs, exercises become demonstrations without improvement.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| ATT&CK Navigator | For coverage visualization |
| Markdown renderer | For report generation |
| Ticketing system access | Jira/GitHub Issues for remediation tracking |

## Key Concepts

### Debrief Structure

```yaml
debrief:
  exercise_name: "Q1 Purple Team Exercise"
  date: "2026-01-15"
  participants:
    red_team: ["operator-1", "operator-2"]
    blue_team: ["analyst-1", "analyst-2", "analyst-3"]
    stakeholders: ["ciso", "soc-manager"]
  phases:
    - name: "Timeline Reconstruction"
      duration: 30  # minutes
    - name: "Red Team Walkthrough"
      duration: 20
    - name: "Blue Team Perspective"
      duration: 20
    - name: "Gap Analysis"
      duration: 15
    - name: "Remediation Planning"
      duration: 15
```

### Finding Classification

| Category | Description | Example |
|---|---|---|
| Detection Gap | No alert for executed technique | T1053.005 — no Sigma rule |
| Visibility Gap | No telemetry for technique | Sysmon not logging pipe events |
| Response Gap | Alert fired but response delayed | LSASS dump alert — 4hr response |
| Coverage Gap | Rule exists but not deployed | Sigma rule not converted to SPL |
| Process Gap | Procedure missing or unclear | No runbook for lateral movement |

### Timeline Format

```
T+00:00  [RED]  Initial access via T1566.001 — phishing macro executed
T+00:02  [BLUE] Email gateway alert — blocked secondary payload
T+00:05  [RED]  PowerShell stager T1059.001 — encoded command execution
T+00:07  [BLUE] SIEM alert — suspicious PowerShell detected ✓
T+00:10  [RED]  Persistence via T1053.005 — scheduled task created
T+00:25  [BLUE] No detection — MISSED ✗
T+00:30  [RED]  Credential dump T1003.001 — LSASS memory access
T+00:32  [BLUE] EDR alert — LSASS access detected ✓
T+00:35  [BLUE] Analyst triage — incident opened
```

## Workflow

### 1. Collect Exercise Data

```bash
# Aggregate red team execution logs and blue team response data
node agent.js collect-data \
  --red-log logs/red_team_exec.json \
  --blue-log logs/blue_team_response.json \
  --siem-alerts logs/siem_alerts.json \
  --output debrief_data.json
```

### 2. Build Timeline

```bash
# Reconstruct unified attack-defense timeline
node agent.js build-timeline \
  --data debrief_data.json \
  --output timeline.json
```

### 3. Classify Findings

```bash
# Auto-classify findings by gap category
node agent.js classify-findings \
  --timeline timeline.json \
  --output findings.json
```

### 4. Generate Debrief Report

```bash
# Produce formatted debrief report
node agent.js generate-report \
  --findings findings.json \
  --timeline timeline.json \
  --output reports/debrief_report.json
```

### 5. Create Remediation Tickets

```bash
# Push findings to ticketing system
node agent.js create-tickets \
  --findings findings.json \
  --ticketing-url https://jira.internal/rest/api/2 \
  --project SECOPS
```

## Verification

| Check | Method |
|---|---|
| Timeline complete | All red team actions have timestamps |
| Findings classified | Each finding has category and severity |
| Remediation assigned | Every finding has an owner and due date |
| Report distributed | Stakeholders received debrief document |

## References

- [MITRE ATT&CK Evaluations](https://attackevals.mitre-engenuity.org/)
- [SANS Purple Team Framework](https://www.sans.org/white-papers/)
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team)
