Purple › Module 9 › Lesson 3
Retrospectives
Retrospectives literacy — hotwash, process gaps, comms wins, next sprint priorities — PIR preview on YOUR `$PURPLE_LAB` purple exercises.
Visual · t35_retrospectives
Retrospectives = named hotwash rows. $PURPLE_LAB. Original Cyberlium.
Opening
Purple exercises improve through retros — name hotwash and priority rows on YOUR lab before skipping post-exercise review.
Retrospectives literacy names: hotwash timing category, what worked category, process gap category, comms/coordination gap category, and next sprint priority category. Analyst documents retrospective preview on `$PURPLE_LAB` exercise thread — five rows with suggested owner stub and priority — without blame-focused red vs blue attacks, without hiding coordination failures, without unauthorized prod remediation from lab gaps. Cyberlium teaches feedback loop vocabulary — YOUR notes. Refused: blame theater, skipping retro, unauthorized prod changes from lab. Lab row: retrospective preview (five rows, owner stub, priority).
1. Named retro rows
Hotwash timing, what worked, process gap, comms gap, next sprint priority — five literacy anchors.
Blameless process focus — document system and coordination gaps.
Command guide
Try these commands — Named retro rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team NIST SP 800-61 lessons — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/findings/retro-template.md" <<'EOF'
# Purple Exercise Retrospective — YOUR template
**Exercise:** PURPLE-LAB-001
## What went well
- jq validation caught failed-logon pattern before live sim
- Exercise plan + RoE kept scope on YOUR lab
## What did not go well
- T1082 gap remains — no automated detection
- Threshold tuning deferred — FP risk on single 4625
## Action items
| ID | Action | Owner | Due |
| PURPLE-FND-001 | Tune failed-logon threshold | det_eng | +14d |
| PURPLE-FND-002 | T1082 rule stub | det_eng | +21d |
## Integrity check
- Confirm no banned atomics run; no stranger-network sims
EOFCommand — copy this
grep -E 'went well|Action items|Integrity|T1082' "$PURPLE_LAB/findings/retro-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); NIST SP 800-61 lessons (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Feedback loop link
Priorities link blue backlog from 9-2 — same improvement thread.
Comms gaps link Module 7 exercise comms rows.
3. Refused
No blame theater; no skip retro; no unauthorized prod changes from lab gaps.
Retro literacy supports continuous improvement — not scapegoating.
4. What you ship: retrospective preview
Five retro rows + owner stub + priority + NEVER blame theater line.
5. What you record before the next lesson
Retrospective preview path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write retro doc naming and shaming red or blue teammates from lab exercise.
Right
Retrospective preview from `$PURPLE_LAB` exercise thread. Next: Findings Lab.
Mission: retrospective preview
1) Name five retro literacy rows. 2) Five rows from exercise thread. 3) Owner stub and priority per row. 4) Write NEVER blame theater line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Comms gap vs detection gap — literacy split in retro?”
Knowledge Check
APPLY: Retrospectives literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Blame theater belongs in purple retros.
True or False
Knowledge Check
APPLY: Retrospective includes:
Multiple choice