Traditional Red Team exercises, in which an attack team tries to infiltrate a company in secret for weeks, are an indispensable test of overall resilience. However, their operating model has some drawbacks - the feedback loop is very long. The defense team (Blue Team) only learns of their weaknesses from the final report, often weeks after the fact, when valuable technical context has faded. It’s like a soccer team receiving an analysis of its losing game a month after the game is over. The information is valuable, but its immediate educational value is limited.
In response to this need to shorten the feedback loop and maximize knowledge transfer, the concept of Purple Teaming was born. This is not another separate team, but a philosophy and format for collaboration between attackers (Red Team) and defenders (Blue Team). Instead of confrontation, there is a joint, interactive workshop aimed at immediately improving detection and response skills. It’s an intensive training session in which the knowledge and perspective of the “red team” is translated live into real, working defense mechanisms for the “blue team.”
Shortcuts
- What is the main purpose of the Purple Team exercise and how does it differ from traditional Red Teaming?
- What roles and competencies are necessary for a successful Purple Team session?
- What role does the MITRE ATT&CK framework play in scenario planning?
- What is the “attack-detect-improve” loop that is the heart of Purple Teaming?
- What specific results and “artifacts” (e.g., new SIEM rules) should emerge from the session?
- How does nFlo facilitate and conduct Purple Team workshops for its clients?
What is the main purpose of the Purple Team exercise and how does it differ from traditional Red Teaming?
While the main objective of the Red Team operation is to answer the question “can we detect and stop an attack?” the main objective of the Purple Team exercise is to answer the question**“how can we become better at detecting and stopping attacks?**”. This is a subtle but fundamental difference in attitude.
In Red Teaming, the attackers’ priority is stealth and avoiding detection. Communication with the Blue Team is zero. The goal is realistic simulation and evaluation.
At Purple Teaming, the priority is knowledge transfer and immediate improvement. Communication between teams is open, continuous and critical to success. The goal is not to “win” one side, but to jointly identify a gap in detection and patch it immediately by creating a new rule, improving a configuration or streamlining a procedure. Purple Teaming is an iterative process, with the ultimate result being a measurable improvement in defensive capabilities, achieved in just a few hours or days.
📚 Read the complete guide: SOC: Security Operations Center - czym jest, jak działa, jak wybrać
What roles and competencies are necessary for a successful Purple Team session?
A successful Purple Team session requires representatives from both worlds who can talk to each other and cooperate.
Red side (attacker):
- Red Team Operator: An experienced pentester or ethical hacker who has a deep, working knowledge of attackers’ tactics, techniques and procedures (TTPs). He or she must not only be able to execute a given attack, but also be able to clearly explain how it works and the traces it leaves behind.
Blue side (defenders):
-
SOC Analyst (L2/L3): A person who works with detection tools (SIEM, EDR) on a daily basis and can analyze logs and alerts.
-
SOC/Detection Engineer: A key figure. This is a specialist who has the technical ability to create and modify detection rules in a SIEM or EDR system. Without this person, the session will remain at a theoretical level.
-
Threat Hunter (optional): A proactive threat hunting specialist who can bring a unique analytical perspective.
Facilitator (“Purple” role): This is often the leader of one of the teams or an external consultant. His or her job is to moderate the session, keep an eye on the schedule and ensure that communication between the two parties is smooth and constructive.
What role does the MITRE ATT&CK framework play in scenario planning?
The MITRE ATT&CK® framework is an absolutely fundamental tool and common language for every Purple Team session. This vast knowledge base, which categorizes all known adversarial tactics and techniques, serves as a “menu” from which the two teams jointly select scenarios to test.
Instead of the vague goal of “let’s test our safety,” the framework allows you to precisely define the scope of the exercise. The planning process is as follows:
-
Risk analysis and prioritization: the team, based on threat intelligence and knowledge of its own organization, identifies which tactics and techniques from the ATT&CK matrix are most likely and most dangerous to it.
-
Selection of techniques to be tested: This selects a specific, limited list of techniques to be tested during the session (e.g., “T1059.001: PowerShell”, “T1003.001: OS Credential Dumping: LSASS Memory”).
-
Preparation of scenarios: The Red Team prepares the specific tools and commands with which it will execute the selected techniques. Blue Team makes sure it has access to relevant logs and data from systems that have the potential to detect these techniques.
With ATT&CK, the exercise is structured, measurable and allows for systematic coverage of successive areas of defense.
What is the “attack-detect-improve” loop that is the heart of Purple Teaming?
The essence of a practical Purple Team session is an iterative cycle that methodically leads to real improvement. This loop, repeated for each selected attack technique, is as follows:
-
Attack (Red Team): the Red Team operator announces: “I am initiating the execution of technique X.” Then, in a controlled environment, he executes a pre-prepared attack, such as an attempt to steal passwords from the LSASS process memory using the Mimikatz tool.
-
Detect (Blue Team): Blue Team analysts are watching their consoles (SIEM, EDR) in real time. Their job is to answer the questions: Did we see an alert? If so, was it of high quality and did it allow them to understand what happened? If not, is there any data at all in the raw logs that would allow detection of this attack?
-
Improve (Together): The collaborative phase begins. Red Team shares the technical details of the attack - what processes were run, what registry keys modified, what network connections established. Based on this information, a detection engineer from the Blue Team, with the support and consultation of the Red Team, live creates or modifies a detection rule in the SIEM/EDR system.
-
Verify (Red Team): after creating a new rule, the Red Team executes the same attack again. The goal is to verify that the new rule worked correctly and generated the expected high-quality alert.
This cycle is repeated until a satisfactory detection level is reached for the technique, and then the team moves on to the next scenario.
The life cycle of the Purple Team exercise in a nutshell
| Phase | Key activities | Responsible team |
|---|---|---|
| 1. Planning | Joint risk analysis. Selection of techniques from MITRE ATT&CK to test. Preparation of the environment and tools. | Red Team, Blue Team, Facilitator |
| 2. Exercise | Iteratively go through an “attack-detect-improve-verify” loop for each of the selected techniques. | Red Team (attacks and shares knowledge), Blue Team (analyzes and creates detection). |
| 3. Summary and conclusions | Joint discussion of results, identified gaps (not only in detection, but also in prevention) and successes. | All participants. |
| 4. Implementation of improvements | Formal implementation of newly created detection rules on a production environment. Planning the next session. | Blue Team, SOC Engineering. |
What specific results and “artifacts” (e.g., new SIEM rules) should emerge from the session?
Unlike the Red Team operation, whose main result is a report, the Purple Team session generates immediate, tangible and operational “artifacts” that directly strengthen the defense.
The most important result is a set of new, battle-tested detection rules for SIEM, EDR or NDR systems. These are specific pieces of code or logic that from now on will automatically alert when real attackers attempt to use the tested techniques.
Other valuable results include:
-
Logging configuration improvements: Often during a session, it turns out that it is impossible to detect a particular technique because systems do not collect the appropriate logs. A recommendation to enable additional auditing becomes an immediate action.
-
Improvements in procedures (playbooks): A team may come to the conclusion that even after detecting an attack, their response procedure is too slow or unclear. The session is an ideal time to refine it.
-
Tremendous knowledge transfer: The most valuable, though immeasurable, result is the knowledge that flows between the teams. The Blue Team learns to think like attackers, and the Red Team begins to understand the limitations and challenges of defenders. This is a priceless investment in competence.
How does nFlo facilitate and conduct Purple Team workshops for its clients?
At nFlo, we are ardent supporters of the Purple Team philosophy because we believe it is the most effective way to build real, not just theoretical, defensive capabilities. We offer comprehensive services in organizing and conducting these advanced exercises, acting as an experienced facilitator and driving force behind the entire process.
Our service is to play the role of “coach” and external Red Team that works hand in hand with your internal Blue Team (SOC). Our process is as follows:
-
Joint planning: We start with a workshop where, based on your company profile and the MITRE ATT&CK framework, we jointly select and prioritize the attack techniques to be tested.
-
Leading the sessions: Our Red Team experts simulate individual attacks while clearly explaining to your team how they work and what traces to look for.
-
Support in building detection: We actively help your analysts and engineers to analyze logs and build live effective detection rules in your tools (SIEM, EDR). We share our knowledge and best practices.
-
Documentation and summary: After the workshop, we provide a detailed report that not only documents all tested scenarios, but also includes ready-to-implement, newly created detection rules and recommendations for further improvements.
Each Purple Team session with nFlo is not just a test, but above all an intensive and extremely valuable knowledge transfer that permanently improves the competence and effectiveness of your security team.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Blue Team — Blue Team is a group of cybersecurity specialists responsible for defending an…
- Backup — Backup, also known as a backup copy or safety copy, is the process of creating…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
Learn More
Explore related articles in our knowledge base:
- How to Build an Effective SOC Team: Key Roles, Competencies, and Processes
- In-house SOC team or outsourcing? What cyber security strategy should you choose for your company?
- Detecting and responding to endpoints with FortiEDR: What you need to know
- Detecting and responding to threats on endpoints with FortiEDR: What do you need to know?
- Enhanced detection and response: the role of FortiXDR in modern security
Explore Our Services
Need cybersecurity support? Check out:
- SOC as a Service - 24/7 security monitoring
- IT Monitoring - 24/7 infrastructure monitoring
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
