purple-team-automation

Purple Team Automation

Authorization Boundary

• Run only in environments with written approval, change windows, and rollback owners.
• Tag every test with a unique campaign-id for cleanup and timeline reconstruction.
• No data destruction, no real credential theft, no third-party services targeted.

Campaign Workflow

1. Pick an adversary or technique set with business relevance; cite ATT&CK IDs and known intrusion sets.
2. Draft an emulation plan: prerequisites, steps, expected telemetry, success/fail criteria, cleanup.
3. Execute with invoke-atomicredteam, caldera operations, stratus, or custom scripts in isolated runners.
4. Capture telemetry across EDR, Sysmon, cloud audit, network, identity, and SIEM.
5. Compare expected vs observed events; flag missing logs, parsing failures, and rule misses.
6. File defensive backlog: new detections, tuning, telemetry enablement, and response runbook updates.

Coverage Scoring

• Prevented, Alerted, Logged-not-alerted, Missed. Score by technique and by data source.
• Track time-to-detect and time-to-contain per test.
• Maintain a heatmap over ATT&CK with last-validated date and confidence.

Output Contract

• plans/<campaign>.md: technique list, steps, expectations.
• runs/<campaign>/: command logs, artifacts, screenshots, raw telemetry.
• coverage.csv: technique × status × evidence × backlog ticket.
• report.md: executive coverage, top gaps, prioritized fixes with owners.