Purple Team Toolkit

Purple team workflow reference. 5-step detection validation cycle, tool selection guide (Caldera, Atomic Red Team, Velociraptor, Sigma), and links to dedicated cheatsheets.

#Purple Workflow

#Detection Validation Cycle

The standard purple team workflow in 5 iterative steps. Each cycle improves detection posture. Prioritize techniques most used by APT groups relevant to your sector (see MITRE ATT&CK Groups).

Step Action Tools Output
1. Plan Select ATT&CK techniques to test based on threat intel and gap analysis ATT&CK Navigator, Coverage Matrix Technique list + test plan
2. Emulate Execute attacks in a controlled environment Caldera, Atomic Red Team, Stratus (cloud) Attack execution evidence
3. Detect Verify if SIEM/EDR generated alerts for each technique Splunk, Elastic, Sentinel, Velociraptor, Wazuh Detection results (detected / not detected)
4. Improve Write or refine detection rules for gaps found in step 3 Sigma (cross-SIEM), YARA, KQL, SPL, custom queries New/updated detection rules
5. Report Document coverage, gaps, and remediation priorities VECTR, ATT&CK Navigator heatmap, Coverage Matrix Coverage report + gap remediation plan

Iterate regularly. Each cycle should be triggered by: new threat intel, infrastructure changes, new tool deployments, or periodic schedule (quarterly minimum).

#Tool Selection Guide

Need Tool Best for
Automated adversary emulation Caldera Repeatable automated kill chain campaigns
Individual technique tests Atomic Red Team Fast, portable single-detection validation
Cloud attack emulation Stratus Red Team AWS/Azure/GCP/K8s detection validation
Endpoint investigation + hunting Velociraptor Live response, VQL fleet queries
Cross-SIEM detection rules Sigma Write once, compile to Splunk/Elastic/Sentinel/QRadar
Campaign tracking + metrics VECTR Measuring detection maturity over time
Host-based IDS + SIEM Wazuh Open source, smaller teams without commercial SIEM
ATT&CK gap analysis Navigator + Coverage Matrix Layer overlays, executive reporting

#Also See

#Official Resources

#Cyber Aurelien Guidi

  • MITRE ATT&CK (Framework reference, techniques, APT groups, detection EIDs)
  • Atomic Red Team (Unit test library for ATT&CK)
  • Caldera (Adversary emulation platform)
  • Velociraptor (DFIR and threat hunting)
  • Sigma (Detection rule standard + Rule Builder widget)
  • Wazuh (HIDS and SIEM platform)