Purple Team
Purple team is not a separate team. It is red and blue working together in the same exercise. Red attacks, blue detects, and both share what they learned.
How Purple Team Works
- Red team attacks - Executes a known technique (e.g., credential dumping with Mimikatz)
- Blue team detects - Monitors logs and alerts to see if they catch the attack
- Both review - Did blue see it? How fast? What logs did it show up in? What did red do that could have been detected earlier?
- Improve detections - Blue writes new rules based on what red did. Red tries again to see if the new detections catch it.
- Repeat - Each iteration makes both sides better
Why Purple Team Matters
- Red team finds vulnerabilities but if blue cannot detect them, the vulnerabilities stay exploitable
- Blue team writes detections but if they never test against real attacks, they do not know if the detections work
- Purple team closes that gap. Every red team finding becomes a blue team detection. Every blue team gap becomes a red team test case.
Purple Team Exercises
Tabletop Exercises
Walk through a scenario on paper. "Attacker sends phishing email with malicious attachment. What happens next?" Good for testing processes and communication without needing infrastructure.
Live Exercises
Red team actually attacks while blue team monitors in real time. More realistic but requires careful planning to avoid disrupting production systems.
Atomic Tests
Run individual ATT&CK techniques against a test machine and check if detections fire. Quick, safe, and repeatable. Tools like Atomic Red Team (Red Canary) provide pre-built test scripts.
Purple Team Practice on Hack The Box
The HTB CJCA certification is explicitly a purple team exam. You do both:
- Red team side - Compromise 5 machines using exploitation and privilege escalation
- Blue team side - Triage approximately 40 SIEM alerts in an Elastic Stack instance, classifying each as true positive or false positive with evidence
This is what makes the CJCA unique - most entry-level certs are purely offensive or purely defensive. The CJCA forces you to do both and understand how they connect.
Frameworks Reference
| Framework | Focus | Use |
|---|---|---|
| MITRE ATT&CK | Attacker tactics and techniques | Map detections to specific adversary behaviors |
| NIST SP 800-61 | Incident response process | Structure your SOC's response workflow |
| NIST NICE Framework | Workforce roles and skills | Map job roles to required competencies |
| Cyber Kill Chain | Attack phases | Understand where to break the attack chain |
| Diamond Model | Incident analysis | Analyze adversary-infrastructure-victim relationships |
| PTES | Penetration testing methodology | Structure offensive engagements |
| OWASP Top 10 | Web application risks | Prioritize web vulnerability remediation |
| CIS Controls | Security baselines | Implement prioritized defense measures |
Getting Started with Purple Team
- Set up a home lab: a Kali VM (attacker) and a Windows VM (defender) with Sysmon + ELK forwarding
- Run Atomic Red Team tests on the Windows VM
- Check if your ELK detections catch the atomic tests
- If not, write new Sigma rules and deploy them
- Re-run the tests and verify the alerts fire
- Move to the next ATT&CK technique
This loop is purple team in its simplest form. You do not need an enterprise SOC to practice it.
Next Steps
- Read up on red team and blue team individually
- Learn the tools both sides use
- Master the fundamentals
- Prepare for the CJCA