Purple team and detection validation

Investment in detection is often an act of faith: you buy an EDR, write correlation rules and assume they work. A purple team exercise replaces assumptions with data. It’s not “we attack and hope they catch us” (that’s red team); it’s an open collaboration where we execute known attack techniques one by one, with your defence team watching the telemetry live, and for each one we record: was it prevented? logged? did it trigger an alert? how long until detection? was the alert correct? The result is an honest picture of what you see — and, more importantly, what you don’t.

How we work (SANS PTEF)

• We plan together (red + blue in the same room) and select the MITRE ATT&CK techniques relevant to your likely adversaries — not the entire catalogue, but what would actually target you
• We execute in a controlled manner, one technique at a time, using adversary emulation (for example, Atomic Red Team for atomic tests, CALDERA for chains)
• For each technique we distinguish the root cause of a gap: no telemetry (the event isn’t collected), telemetry without a rule (the data exists but nothing correlates it) or rule without an alert (the rule is poorly calibrated)
• We tune detections on the spot, re-run and confirm the gap is closed

What we measure and what you get

• Detection rate, mean time to detection (MTTD) and to response (MTTR), alert fidelity, gap-closure rate from one round to the next
• An ATT&CK coverage map: detected vs logged-only vs missed, by tactic and technique
• A detection-gap register, with the root cause of each
• New and tuned detection rules (Sigma / EDR / SIEM), delivered and validated
• An improvement plan and baseline metrics for the next round