Purple › Module 6 › Lesson 2
Scope and RoE
Scope and RoE literacy — authorized hosts, time windows, technique allowlist, rollback plan — purple exercise boundaries on YOUR `$PURPLE_LAB`.
Visual · t35_scope_and_roe
Scope and RoE = named purple boundaries. $PURPLE_LAB. Original Cyberlium.
Opening
Purple exercises fail without written RoE — name authorized hosts and technique allowlist on YOUR lab before any atomic or simulation run.
Scope and RoE literacy names: authorized host inventory category, exercise time window category, technique allowlist category, rollback and cleanup plan category, and escalation contact stub category. Analyst writes purple RoE stub on `$PURPLE_LAB` — lists lab VM hostnames, allowed ATT&CK techniques for current sprint, forbidden paths (prod, stranger networks, destructive atomics literacy) — without assuming implicit authorization, without expanding scope mid-exercise without re-sign. Cyberlium teaches professional purple boundaries on YOUR notes — defender coordination literacy only. Refused: scope creep to prod, stranger org inclusion, verbal-only RoE. Lab row: purple RoE stub (hosts, window, allowlist, rollback, escalation).
1. Named RoE rows
Authorized hosts, time window, technique allowlist, rollback plan, escalation contact — five literacy anchors.
RoE signed before first atomic — not retroactive justification.
Command guide
Try these commands — Named RoE rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Atomic Red Team — https://github.com/redcanaryco/atomic-red-team MITRE ATT&CK — https://attack.mitre.org/ NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/atomic/exercise-roe.md" <<'EOF'
# Purple Exercise RoE — YOUR lab VM only
## Authorized scope
- Hosts: YOUR lab VMs listed in exercise plan (RFC1918 lab VLAN)
- Techniques: pre-approved safe list (T1082) OR tabletop + jsonl replay
## Prohibited
- Ransomware atomics; credential dump atomics (T1003.* homework)
- Attack sims against production stranger networks
- Destructive tests; lateral movement to unauthorized hosts
## Approvals
- Written exercise plan signed by purple lead (fictional tabletop OK)
- Snapshot lab VM before optional Invoke-AtomicTest
## Evidence
- Log capture window UTC; detection fired Y/N; tuning notes
EOFCommand — copy this
grep -E 'Prohibited|T1082|stranger|snapshot' "$PURPLE_LAB/atomic/exercise-roe.md" grep NEVER "$PURPLE_LAB/notes/no-stranger-sims.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); MITRE ATT&CK (https://attack.mitre.org/); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Allowlist discipline
Techniques outside allowlist require RoE amendment stub — document on lab notes.
Link Module 1 lab-hosts-only rows — same host inventory thread.
3. Refused
No prod host inclusion without ticket; no stranger org networks; no verbal-only scope.
RoE literacy supports safe purple work — not red-team free-for-all.
4. What you ship: purple RoE stub
Hosts + window + allowlist + rollback + escalation + NEVER stranger-network scope line.
5. What you record before the next lesson
Purple RoE stub path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add employer prod server to atomic scope mid-exercise because 'detection needs realism.'
Right
Purple RoE stub from `$PURPLE_LAB` lab inventory. Next: Safe Lab Tests.
Mission: purple RoE stub
1) Name five RoE literacy rows. 2) Authorized host inventory from lab setup. 3) Technique allowlist for current sprint. 4) Write NEVER stranger-network scope line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “RoE amendment — minimum literacy stub?”
Knowledge Check
APPLY: Purple RoE literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Verbal-only scope is sufficient for atomic runs.
True or False
Knowledge Check
APPLY: RoE stub includes:
Multiple choice