Purple Team
Close the Gaps the Red Team Found
Read a red team report, decide what your SOC actually caught, and write the detections that close the gaps — then watch the red team run it back with variations you haven't seen.
Guided by The Dualist
What it is
Purple Team, defined
Purple teaming puts red and blue at the same table. The red team runs an emulated adversary chain; the defenders go through it step by step and answer one question honestly — did we see that? Every step that slipped through leaves the room with a detection, and every detection gets tested again against the same behaviour done a different way. It's the exercise that turns a red team's findings into coverage, instead of a report that gets filed and forgotten.
The career
The exercise behind detection work
Purple teaming isn't a job title — it's an exercise security teams run on a cadence, red and blue working the same chain together. The people who run it well are detection engineers and SOC leads, and what it builds is the core of those jobs: reading adversary tradecraft, judging coverage from evidence, and writing detections that hold up when the attack changes.
Builds toward
Detection Engineer
Typical salary
$135K/yr avg
Who you'd work alongside
- Detection engineers who own the fixes
- Red team and emulation operators running the chain
- SOC analysts working the alert queue
- Security leads tracking coverage against MITRE ATT&CK
The DefendTheOrg approach
How you'll learn it
On Defend the Org you work a red team report under The Dualist — a former operator who treats any detection keyed on a filename as one that hasn't been tested yet. You're graded on the whole purple loop, not just the rule:
Make the coverage call
For every step: Detected, Logged but not detected, Partial, or Not logged. The call comes from the evidence — the telemetry the step left and the alerts that fired on it — not from an alert that happened to land nearby.
Write the detection
Close each gap with a rule that catches the step's behaviour and stays quiet on the legitimate activity that looks like it. Tune the deployed rule that half-works instead of disabling it.
Survive the replay
Hidden variants run against your rules: a renamed binary, a different parent process, a living-off-the-land swap for the same goal. Only rules that describe the behaviour, not one string, survive.
Map it and fill the blind spot
Map each detection to the ATT&CK technique it actually covers. When a step left no telemetry at all, name and onboard the log source that would have seen it before you write the rule.
Stuck? Get walked through it.
Every Easy and Medium lab has a walkthrough from The Dualist — one hint at a time, with a chance to try each step yourself before the answer. You get three a week, and using one never touches your score. It teaches the reasoning, not the solution.
Try it yourself
A taste of the real lab
This is a simplified, no-signup slice of a Purple Team lab — make your call and see how it's graded. The real labs go deeper.
Survive the replay
The red team's report shows a Word document starting a script host, and your SOC caught it. Now they run it back. Which rule survives?
- Report event: winword.exe starts wscript.exeshould flag
- Replay: script host copied and renamed docview.exeshould flag
- Replay: excel.exe starts wscript.exeshould flag
- Benign: logon script, userinit.exe starts wscript.exeshould not flag
Push yourself
Where Hard and Expert labs take you
Every skill scales from your first lab to genuinely hard reasoning. Difficulty isn't a bigger wall — it's deeper thinking.
Hard
Hard labs hand you a real queue: unrelated SOC noise across the estate, and distractor alerts on the chain's host minutes from a real step, so matching on time alone gets the call wrong. You aren't told how many detections are needed — your rule set is graded as a whole, and the test cases are numbered rather than named.
Expert
Expert labs give you a report that's partly wrong — a step claimed as successful that the telemetry shows failed. Alerts overlap, severities mislead so the queue can't be sorted by them, and ATT&CK mapping is graded at the sub-technique rather than the technique.
Start purple team training
Hands-on labs built from real engagement data. Learn by doing — guided by The Dualist.