Red Team and Adversary Simulation
Purple Team Exercise
We run attack techniques step by step with your defense team. For each technique that goes unseen, a detection rule is written during the session and tested again.
What it is
A Purple Team exercise brings the attack and defense teams together around a single goal. The attack side runs a technique while the defense side simultaneously looks for it in the logs. For any technique that goes unseen, the missing log source or rule is identified and fixed during the session. The exercise focuses on learning and measurable detection coverage rather than stealth.
Scope
- List of techniques selected from MITRE ATT&CK relevant to your sector
- Each technique monitored in your SIEM, EDR and network monitoring tools
- Identification of missing log sources and configurations
- Detection and correlation rules written and tuned during the session
- Each technique rerun with the new rule
The need
When organizations need it
- After moving to a new SIEM, EDR or MDR service, when you want to measure what is detected.
- When a Red Team operation reveals steps your defense missed and you want to build their detection with your team.
- When you want your SOC team to develop hands-on skills to recognize real attacker behavior.
Method
How we work
-
Technique selection
We prepare a list of techniques based on threats to your sector and previous findings.
-
Joint session
We run each technique with your team and simultaneously review how it appears in the logs.
-
Rule development
For any technique that goes unseen, we adjust the log source or rule during the session.
-
Rerun
We run the same technique again and check if the new rule generates an alert.
Outcome
What you have at the end
You have a detection coverage matrix showing which techniques are detected. The rules written and tested in the sessions are active in your environment.
Frequently asked questions
How is it different from a Red Team operation?
A Red Team operation measures your defense's real response without prior notice. A Purple Team exercise works with your defense team and aims to improve detection during the session.
Who from our team should take part?
SOC analysts, detection rule writers and relevant system administrators participate. If your SOC is outsourced, the provider is included as well.
Do we need to buy a new tool?
No. The rules are written in the SIEM and EDR products you already use.
Red Team and Adversary Simulation
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting