Building the Always-On Purple Team
summary
Claims that purple teaming moves from periodic assessments to continuous, always-on testing by automating execution of MITRE ATT&CK TTPs using BAS tools (CALDERA, Atomic Red Team, Prelude Operator) orchestrated from a SOAR (XSOAR, Siemplify, Swimlane) with VECTR for documentation. Demonstrations show playbooks that run TTPs, check EDR/SIEM alerts, and report coverage so detection gaps surface monthly rather than yearly; full autonomous red teams are not ready yet. Example mitigation tested: Credential Guard prevents LSASS credential dumping. instrumented representative hosts and automated emulation pipeline prove the approach works for continuous detection validation.
AI-written summary · about
chapters (17)
- 0:00Introduction to speakers
- 4:08Speaker background and context
- 5:50Defining purple teaming
- 6:54Challenges in team alignment
- 11:11Improving red team impact
- 15:04Bridging team communication
- 17:34Enhancing blue team defense
- 21:05Continuous purple improvement
- 23:05Deep dive into defenses
- 25:43Levels of purple teaming
- 28:33Tools for collaboration
- 32:22Automating purple teaming
- 36:57Adversary emulation pipeline
- 39:47Infrastructure and tooling
- 43:25Practical implementation example
- 46:14Future strategy and conclusion
- 48:47Questions and answers
related talks
41mPurple Is the New Red - Providing the Most Value from Offensive Security
53mIncreasing Security ROI with Adversary Simulation and Purple Teaming
43mShades of Purple: Getting Started and Making Purple Teaming Possible
25mStandard Classification: Purple Teaming with PurpleTeam
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
45mThis is application purple teaming
29mPurple Teaming with OWASP PurpleTeam
30mPurple Teaming with OWASP PurpleTeam