Retrospectives

Retrospectives literacy — hotwash, process gaps, comms wins, next sprint priorities — PIR preview on YOUR `$PURPLE_LAB` purple exercises.

Retrospectives• Audio Walkthrough

00:00/02:55

Visual · t35_retrospectives

Retrospectives = named hotwash rows. $PURPLE_LAB. Original Cyberlium.

Purple exercises improve through retros — name hotwash and priority rows on YOUR lab before skipping post-exercise review.

Retrospectives literacy names: hotwash timing category, what worked category, process gap category, comms/coordination gap category, and next sprint priority category. Analyst documents retrospective preview on `$PURPLE_LAB` exercise thread — five rows with suggested owner stub and priority — without blame-focused red vs blue attacks, without hiding coordination failures, without unauthorized prod remediation from lab gaps. Cyberlium teaches feedback loop vocabulary — YOUR notes. Refused: blame theater, skipping retro, unauthorized prod changes from lab. Lab row: retrospective preview (five rows, owner stub, priority).

1. Named retro rows

Hotwash timing, what worked, process gap, comms gap, next sprint priority — five literacy anchors.

Blameless process focus — document system and coordination gaps.

Command guide

Try these commands — Named retro rows

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

MITRE ATT&CK — https://attack.mitre.org/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team NIST SP 800-61 lessons — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/findings/retro-template.md" <<'EOF'
# Purple Exercise Retrospective — YOUR template
**Exercise:** PURPLE-LAB-001
## What went well
- jq validation caught failed-logon pattern before live sim
- Exercise plan + RoE kept scope on YOUR lab
## What did not go well
- T1082 gap remains — no automated detection
- Threshold tuning deferred — FP risk on single 4625
## Action items
| ID | Action | Owner | Due |
| PURPLE-FND-001 | Tune failed-logon threshold | det_eng | +14d |
| PURPLE-FND-002 | T1082 rule stub | det_eng | +21d |
## Integrity check
- Confirm no banned atomics run; no stranger-network sims
EOF

Command — copy this

grep -E 'went well|Action items|Integrity|T1082' "$PURPLE_LAB/findings/retro-template.md"

Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); NIST SP 800-61 lessons (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Feedback loop link

Priorities link blue backlog from 9-2 — same improvement thread.

Comms gaps link Module 7 exercise comms rows.

3. Refused

No blame theater; no skip retro; no unauthorized prod changes from lab gaps.

Retro literacy supports continuous improvement — not scapegoating.

4. What you ship: retrospective preview

Five retro rows + owner stub + priority + NEVER blame theater line.

5. What you record before the next lesson

Retrospective preview path.

6. Wrong vs right: stranger networks vs YOUR purple lab

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Write retro doc naming and shaming red or blue teammates from lab exercise.
Right: Retrospective preview from `$PURPLE_LAB` exercise thread. Next: Findings Lab.

Hands-on Exercise