Purple Team Services

A red team engagement shows where defenses failed, but usually only after the fact. In a purple team exercise, the trace of each technique in your SIEM, EDR and other tools is reviewed as it runs, and missing logs or rules are addressed in the same session.

The outcome is a measurable detection coverage map and concretely improved rules.

1. Scenario selection: Priority MITRE ATT&CK techniques are chosen based on threats targeting your sector.
2. Baseline: Existing log sources and SIEM and EDR rules are reviewed.
3. Joint execution: Each technique is executed in a controlled way while the SOC checks alerts, logs and visibility.
4. Gap analysis: Missing log sources or rules are identified for undetected or late-detected techniques.
5. Improve and repeat: New or updated detection rules are retested with the same technique.

• Before-and-after detection coverage map on MITRE ATT&CK.
• Result for each technique: blocked, alerted, logged or not visible.
• Recommended and tested detection rule logic and log source improvements.
• Recommendations for SOC processes and response steps.

Organizations that run an in-house SOC or use a managed SOC, want to measure the value of a new SIEM or EDR investment, or want their analysts to recognize real attack traces.

Purple team exercises usually run as pre-planned sessions, remotely or on site. Each session focuses on a specific attack stage, such as initial access, privilege escalation or lateral movement.

The sessions also serve as hands-on training for your SOC analysts.