Course Objective & Scope
When Red Team assessments run in isolation from defenders, findings rarely translate into durable detection rules. This programme bridges adversary emulation, Blue Team telemetry and detection engineering through a structured Purple Team methodology mapped to MITRE ATT&CK.
In an isolated training lab, participants execute controlled adversary TTPs, inspect the resulting telemetry in EDR/SIEM tools, write Sigma detection rules and leave with a reusable Purple Team exercise playbook.
Who Should Attend?
- SOC analysts, Blue Team and detection engineering specialists
- Penetration testers and Red Team operators
- Cybersecurity operations leads and threat hunting teams
- Prerequisite: foundational knowledge of network/OS security and log analysis
Key Takeaways
- Map relevant threat actor TTPs onto the MITRE ATT&CK matrix
- Run controlled adversary emulation scenarios in an authorised lab environment
- Identify attack traces across Windows/Linux, Active Directory and EDR telemetry
- Write Sigma rules and SIEM correlation logic to close detection gaps
- Build a repeatable Purple Team exercise plan and detection coverage scorecard
Curriculum
Red, Blue and Purple Team Operating Models
- Differences between penetration testing, Red Team operations and Purple Team collaboration
- Threat profiling and exercise scoping with MITRE ATT&CK
Red Team Perspective: Controlled Adversary Emulation
- Initial access, privilege escalation, credential dumping and lateral movement TTPs
- Running Atomic Red Team and emulation scenarios in a safe lab
Blue Team Perspective: Telemetry and Detection Engineering
- Analysing Sysmon, Windows Event Logs, Linux auditd and EDR signals
- Behavioural detection, Sigma rule authoring and reducing false positives
Hands-On Purple Team Loop: Execute, Observe, Improve
- Step-by-step TTP execution, SIEM/EDR visibility validation and rule tuning
- Updating prevention and detection coverage scores
Exercise Reporting and Continuous Validation
- Building coverage heatmaps with MITRE ATT&CK Navigator
- Creating a reusable internal Purple Team exercise playbook
Other Courses in This Category
-
The NIST SP 800-61 lifecycle, incident triage, DFIR evidence collection, containment and root-cause analysis for security and IT teams managing cyber incidents under pressure.
- Live Course
- 5 modules
-
Log architecture, normalization, correlation rules, MITRE ATT&CK-based detection, alert triage and threat hunting for SOC analysts and security engineers reducing alert fatigue and catching real threats.
- Live Course
- 5 modules
-
SOAR playbooks, LLM and security agents for automated enrichment, alert triage, case summarization and human-in-the-loop response for SOC and security engineers scaling operations.
- Live Course
- 5 modules
-
Evasion, data poisoning, backdoors, model extraction and membership inference attacks and defenses under MITRE ATLAS for data science and security teams testing ML model robustness.
- Live Course
- 5 modules
-
OWASP Top 10 for LLM & Agentic Applications, direct/indirect prompt injection, RAG data leakage, MCP/tool-calling authorization and guardrail architectures for engineers building secure AI systems.
- Live Course
- 5 modules
-
ISO/IEC 27001:2022 clauses, asset and risk assessment, Annex A controls, Statement of Applicability (SoA) and internal audit readiness for teams establishing and operating an ISMS.
- Live Course
- 5 modules
Get in touch
