Training / Blue and Purple Team Training

Translate adversary behavior into defensive action.

Scenario-based education and exercises bridge the language and operating-model gap between offensive and defensive teams, converting adversary techniques into actionable detection, telemetry, engineering, investigation, and response requirements.

Request a Blue and Purple Team Training Mission Brief Review the curriculum

Mission

What this training is designed to accomplish.

Prepare defensive and cross-functional security teams to understand relevant adversary behavior, test their assumptions, validate coverage, improve detections and playbooks, and carry operational lessons into the next mission cycle.

Explore Purple Team and Operational Integration services

Operational problem

The readiness gap this track addresses.

Red-team findings do not automatically become better defenses. Offensive and defensive teams may describe the same activity in different ways, coverage assumptions may remain untested, and after-action lessons may never reach telemetry, detection, investigation, or response owners.

Who this is for

Instruction aligned to role and responsibility.

Final audience, depth, and exercises are shaped during scoping so the program reflects the people, tools, environment, and decisions involved.

Blue-team analysts

Defenders responsible for monitoring, investigation, detection, response, and operational improvement.

Detection and security engineers

Practitioners who translate threat behavior into telemetry requirements, detection logic, and response workflows.

Red, purple, and security leads

Personnel responsible for exercise design, cross-team coordination, coverage assessment, and lessons learned.

Curriculum areas

Knowledge connected to operational action.

Curriculum is selected according to the agreed objective. The areas below describe the available focus, not a fixed requirement that every engagement use the same sequence or depth.

Adversary Behavior for Defenders

Develop an understanding of adversary tactics, techniques, and procedures relevant to the systems and mission in scope. Follow how offensive actions progress through an attack path, what evidence they can leave behind, and where defenders can observe, investigate, or interrupt that activity.

Connect adversary objectives and prerequisites to the environment in scope
Trace attack paths across identities, endpoints, applications, and networks
Identify observable behavior, artifacts, and defensive observation points
Examine how technique variations and evasion affect defensive visibility
Distinguish observed evidence from assumptions about adversary activity
Use relevant scenarios to identify investigation and response decisions

Red-to-Blue Translation

Translate offensive actions, exercise evidence, and red-team playbooks into requirements that defensive teams can implement and validate. Connect each scenario to the telemetry, detection logic, investigation questions, response decisions, and engineering changes needed to improve operational coverage.

Break offensive scenarios into actions, prerequisites, and expected artifacts
Define telemetry sources, collection needs, and data-quality requirements
Develop detection hypotheses and identify opportunities for correlation
Translate findings into investigation questions and analyst workflows
Identify response actions, engineering changes, and responsible owners
Set acceptance criteria that connect defensive requirements to retesting

ATT&CK-Oriented Coverage Review

Use MITRE ATT&CK to organize relevant adversary behavior and examine the evidence supporting defensive visibility and detection coverage. Review techniques and sub-techniques against the actual environment, separating documented mappings from demonstrated detection and identifying improvements that matter to the mission.

Select relevant techniques and sub-techniques for the threats and systems in scope
Map scenarios, detections, and observations to applicable ATT&CK behavior
Review required telemetry, collection gaps, and detection dependencies
Assess coverage evidence, validation results, and untested assumptions
Identify behavior variations and investigation or response gaps
Prioritize improvements and record ownership, evidence, and retest criteria

D3FEND-Oriented Coverage Review

Use MITRE D3FEND to examine the defensive techniques implemented across the environment, how they act on relevant digital artifacts, and the evidence that they address the threats in scope. Connect this review to ATT&CK-oriented findings to identify practical countermeasure and engineering improvements.

Map implemented countermeasures to D3FEND defensive techniques
Examine digital artifacts, telemetry dependencies, and deployment assumptions
Relate adversary behavior to applicable defensive techniques and their limitations
Review configuration and validation evidence rather than relying on product claims
Identify missing, overlapping, or ineffective defensive capabilities
Prioritize countermeasure improvements and define evidence for retesting

EMB3D-Oriented ICS and Embedded Device Review

When industrial control systems (ICS), operational technology (OT), or embedded devices are in scope, apply MITRE EMB3D to connect device properties to relevant threats and associated mitigations. Review findings in the context of process safety, availability, vendor constraints, and the authorized operating environment.

Identify relevant hardware, firmware, software, network, and interface properties
Map device properties to applicable EMB3D threats and threat prerequisites
Review associated mitigations, implementation evidence, and device limitations
Connect device-level findings to ATT&CK for ICS scenarios where applicable
Define safe learning and validation scenarios with operational and engineering owners
Document mitigation priorities, residual risks, and approved follow-on actions

ATT&CK, D3FEND, and EMB3D Mapping

Build a traceable view that connects ATT&CK adversary behavior to applicable D3FEND defensive techniques and, when embedded devices are in scope, EMB3D device properties, threats, and mitigations. Evaluate each relationship against the scenario and environment, recording supporting evidence and limitations before turning the findings into defensive requirements.

Start with relevant ATT&CK behavior and identify affected assets and expected artifacts
Select applicable D3FEND countermeasures and examine their operating dependencies
For ICS and embedded devices, connect device properties to EMB3D threats and mitigations
Distinguish published framework relationships from analyst-developed mappings and document assumptions
Build a scenario-based mapping with evidence, gaps, owners, and validation criteria
Use the combined review to prioritize engineering, detection, mitigation, and retesting actions

Detection Validation

Evaluate whether the agreed defensive capabilities produce the expected evidence, alerts, and operational actions during controlled validation. Follow the full path from activity and telemetry collection to detection, triage, investigation, and escalation so findings can inform tuning and repeatable retesting.

Define detection hypotheses, expected evidence, and success criteria
Select authorized test scenarios, safety boundaries, and stop conditions
Verify telemetry collection, parsing, timing, and correlation behavior
Review alert context, analyst triage, investigation, and escalation
Identify missed detections, false positives, and workflow weaknesses
Tune affected capabilities and repeat tests to confirm improvement

Purple-Team Exercises

Practice coordinated offensive and defensive learning through scenarios built around agreed mission and readiness objectives. Teams share observations, clarify assumptions, and adapt authorized exercise activity to answer defensive questions while maintaining clear communications, operational boundaries, and evidence handling.

Define exercise objectives, participant roles, and authorized scenarios
Establish rules of engagement, communications, and stop conditions
Coordinate offensive actions with defensive observation and investigation
Turn blue-team questions into targeted red-team validation requirements
Capture exercise timelines, evidence, decisions, and coordination gaps
Debrief findings and identify changes to practice in the next exercise

Lessons Learned

Convert exercise and validation observations into a clear record of what worked, where readiness fell short, and which improvements should follow. Review evidence with the responsible teams, assign practical actions, and define how changes to technology, workflows, playbooks, and training will be reassessed.

Reconstruct exercise timelines and compare results with agreed objectives
Separate demonstrated findings, contributing factors, and unresolved questions
Identify technical, procedural, communication, and training improvements
Prioritize actions with owners, dependencies, and completion criteria
Update playbooks, analyst references, and engineering requirements
Define follow-up validation and readiness reassessment using recorded evidence

Learning approach

Designed for transfer, practice, and retention.

Objective led

Exercises begin with a defined learning or validation objective, not activity for its own sake.

Evidence based

Teams examine what telemetry, detections, alerts, and actions actually occurred.

Collaborative

Offensive and defensive perspectives are translated into a shared operational picture.

Improvement focused

Findings become owned actions, updated playbooks, engineering requirements, and future validation targets.

Participant takeaways

What personnel can carry into the work.

A defender-focused understanding of relevant adversary tactics, techniques, and procedures
Methods for translating offensive actions into telemetry, detection, and response requirements
Practice reviewing ATT&CK-oriented coverage and validating defensive assumptions
Methods for reviewing D3FEND countermeasures, dependencies, and evidence of defensive effectiveness
When ICS or embedded devices are in scope, practice mapping EMB3D device properties to threats and mitigation requirements
A traceable method for connecting ATT&CK behavior, D3FEND countermeasures, and applicable EMB3D threats and mitigations
Experience coordinating red, blue, and purple perspectives during controlled exercises
A structured approach to after-action learning and operational improvement

Organizational outcomes

What the engagement can leave behind.

Training and exercises aligned to agreed objectives, systems, and authorized scenarios
Documented observations about visibility, detection, workflow, and coordination gaps
Evidence-based ATT&CK and D3FEND coverage findings tied to practical defensive improvements
When in scope, EMB3D device threat and mitigation findings informed by ICS and OT operating constraints
Actionable engineering, playbook, process, or training recommendations
Lessons learned and priorities that can feed future validation and readiness work

Client requirements

What helps the training succeed.

Defined learning and validation objectives with authorized exercise boundaries
Participation by relevant defensive, engineering, offensive, or leadership roles
Access to the agreed telemetry, detections, playbooks, or training environment
A shared understanding of evidence handling, communications, safety, and escalation
For ICS, OT, or embedded device work, agreed device documentation, vendor restrictions, operational owner participation, and safe validation boundaries
Owners who can evaluate findings and accept follow-on improvement actions

End state

Demonstrated capability, not attendance alone.

Security teams share a clearer operating language, understand how adversary behavior should appear in their environment, can validate detections and workflows, and have documented improvements they can implement, practice, and reassess.

Define the readiness objective

Tell us what your people must be ready to do.

The Mission Brief opens a pre-addressed email with a short planning template. Share the audience, environment, tools, current skill level, and desired end state so the training can be scoped around the mission.

Request a Blue and Purple Team Training Mission Brief