Purple Teaming: Closing the Loop Between Attack and Detection

The Problem With Traditional Red Team Reports

A standard red team engagement works like this: the offensive team operates covertly, tries to achieve objectives without being caught, and delivers a report at the end summarizing what worked. The blue team reads it, maybe weeks or months later, and has to reverse-engineer exactly which detection failed and why.

Meanwhile blue teams often write detection rules in isolation, without ever confirming those rules actually fire against a real execution of the technique they're meant to catch. Two teams, two blind spots, no feedback loop.

Purple teaming is the fix: red and blue work together, in real time, so that every attack execution is immediately paired with a detection check.

A Concrete Example: DCSync

Say the red team executes a DCSync attack against Active Directory, which abuses domain replication to pull password hashes.

In a traditional engagement, the report just says "DCSync was successful." In a purple team exercise, the blue team is watching the SIEM, EDR, and domain controller logs while the attack runs. If nothing alerts, both teams stop and figure out why immediately. Two common causes:

• The SIEM has no rule for DsGetNCChanges replication requests originating from a non-domain-controller host.
• The relevant Windows event (Event ID 4662) isn't even being collected.

The blue team writes and deploys the detection rule on the spot. The red team re-executes the exact same attack to confirm the new rule fires with an alert an analyst could actually act on. That's the whole point: verified, not assumed.

MITRE ATT&CK as the Shared Language

Purple teaming needs a common vocabulary so both teams are testing and measuring the same thing. MITRE ATT&CK provides that: a catalog of adversary techniques organized under tactical objectives like initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, and command and control.

Teams use ATT&CK to pick which techniques to test in a given session, track what's covered across the matrix over time, and prioritize based on techniques known to be used by threat actors relevant to their industry.

Exercise Structure

A purple team exercise generally follows six steps:

1. Scope and prioritize — pick ATT&CK techniques based on threat intel for your industry. You can't test everything in one sitting.
2. Baseline detection — document what rules, log sources, and response procedures already exist for each chosen technique, before anything is executed.
3. Execute and observe — red runs each technique while blue watches every detection layer: SIEM, EDR, NDR, firewall logs. Both sides document what happened.
4. Analyze gaps — for each technique, determine if it was detected, at which layer, how long it took, and whether the alert gave an analyst enough context to investigate.
5. Remediate and retest — build or tune detections for the gaps found, then re-run the attack to confirm the fix works with acceptable fidelity.
6. Document and track — log everything in an ATT&CK coverage heatmap. This becomes an ongoing detection maturity scorecard.

Atomic Red Team

Atomic Red Team is an open-source library of small, focused test scripts, each mapped to a specific ATT&CK technique. An "atomic test" does one thing: dump LSASS memory, create a scheduled task for persistence, run DNS tunneling, and so on.

They're designed to be safe to run in production with proper authorization, which makes them the practical building blocks of a purple team exercise. Instead of designing a custom attack script for every technique, teams pull an atomic test off the shelf and work through the ATT&CK matrix systematically.

Metrics That Matter

Metric	Description	Target
Detection Coverage	% of tested ATT&CK techniques with working detections	Increase each quarter
Mean Time to Detect	Average time from attack execution to alert generation	Under 5 minutes for priority techniques
Alert Fidelity	True positive vs. false positive ratio per rule	Above 80% true positive rate
Response Completeness	Whether runbooks cover all investigation/containment steps	Full coverage for top 50 techniques

These give you something a narrative pentest report doesn't: a trackable scorecard of detection maturity over time, not just a snapshot of what one red team happened to bypass on one particular day.

Why It's Worth Adopting

Purple teaming turns security testing from a periodic, adversarial exercise into an ongoing, collaborative one. Instead of finding out three months later that a technique slipped through, you find out immediately, fix it immediately, and verify the fix immediately.

The full lesson, with the complete exercise framework and metrics breakdown, is free here: Purple Teaming