Purple › Module 2 › Lesson 3
Roles Comms
Roles comms literacy names exercise briefings, findings handoffs, and detection backlog channels — assign comms on YOUR $PURPLE_LAB tabletop roster.
Visual · t35_roles_comms
Roles comms literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
Sim logs without handoffs waste blue time — literacy names purple comms so findings reach detection engineers on lab exercises you document.
Purple comms include pre-exercise briefings — scope, techniques, expected telemetry. During-exercise status — red progress, blue alert queue. Post-exercise findings — technique ID, detection result, tuning recommendation, backlog ticket. One accountable channel prevents duplicate work and lost findings. Cyberlium maps comms on YOUR $PURPLE_LAB — assign comms artifacts for three fictional exercise phases. Next: Concepts Lab.
1. Comms artifacts (named)
Pre-exercise brief: scope, lab hosts, ATT&CK techniques, success criteria, rules of engagement. Status cadence: red technique log, blue alert summary, purple gap notes. Findings report: technique, detection result, tuning action, backlog priority.
On $PURPLE_LAB, write comms row — phase, artifact, owner role for one fictional exercise.
Command guide
Try these commands — Comms artifacts (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Splunk security content — https://github.com/splunk/security_content Atomic Red Team — https://github.com/redcanaryco/atomic-red-team
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/notes/purple-roles-comms.txt" <<'EOF'
Purple exercise roles — NAMED LITERACY:
Purple lead: scope, RoE, technique selection, findings synthesis
Detection engineer: Sigma/SIEM rule author, test harness, tuning
SOC observer: alert workflow, triage notes, FP documentation
IT ops (lab): snapshot/restore YOUR lab VM; no prod changes
Comms: pre-exercise brief, live status channel, post-exercise retro
Lab: assign fictional names — document comms plan in exercises/ folder
EOFCommand — copy this
grep -E 'Purple lead|Detection engineer|SOC observer|RoE' "$PURPLE_LAB/notes/purple-roles-comms.txt" curl -sS https://github.com/redcanaryco/atomic-red-team | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Splunk security content (https://github.com/splunk/security_content); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why comms literacy prevents lost findings
Red sim logs in chat without ticket lose detection follow-up. Blue tunes wrong rule because handoff lacked technique context. Documented comms survive shift changes and feed coverage matrices.
Students assign lab comms on notes — production comms follow org templates and ticketing systems.
3. Lab boundary
Forbidden: sharing sim results against stranger networks in public channels. Allowed: roles comms card — three phases with $PURPLE_LAB fictional artifacts.
Ship: roles comms card for YOUR lab exercise. Next: Concepts Lab.
4. What you ship: roles comms card for $PURPLE_LAB
Pre, during, post comms artifacts with owners. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Roles comms card. $PURPLE_LAB named. File t35-m02-l03-roles-comms.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Post sim logs in Discord without findings format. Skip pre-exercise brief entirely.
Right
Write roles comms card for YOUR $PURPLE_LAB. Next: Concepts Lab.
Mission: assign comms on YOUR lab exercise
1) Define pre, during, post comms artifacts. 2) Write comms row for three exercise phases. 3) Confirm one owner per artifact. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Findings report is the handoff — sim without report is entertainment, not engineering.
Knowledge Check
APPLY: Post-exercise findings report primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Pre-exercise brief includes scope, lab hosts, and success criteria.
True or False
Knowledge Check
APPLY: Roles comms literacy on Cyberlium uses:
Multiple choice