Purple Loop
Plan-do-check-act purple cycle on $LAB_RT — emulate, measure detections, tune, re-test; improve defenses, not attacker concealment.
Visual · t21_purple_loop
Purple loop = emulate → detect → tune → re-test on $LAB_RT. Original Cyberlium.
Purple team is a feedback loop with blue — not red team 'winning' by turning off the SIEM.
The purple loop: plan emulation aligned to threat intel and RoE; execute on $LAB_RT; collect defender telemetry; review detections map with blue; tune rules or controls; re-emulate to verify improvement. Success is increased detection coverage and reduced dwell time in lab — not permanent evasion or silent compromise of unauthorized networks. Cyberlium teaches loop facilitation, meeting notes, and objective scoring on authorized exercises — NOT adversarial purple where red hides from blue, NOT disabling EDR in prod, NOT using loop as excuse for stranger access. Each cycle ends with documented gaps closed or accepted risk per stakeholder.
1. Loop phases
Plan: objectives, TTPs, RoE, success criteria. Execute: $LAB_RT only. Review: map + timeline. Tune: blue owns changes. Re-test: confirm alert fires.
Time-box cycles — snapshot revert between iterations on lab bench.
Command guide
Try these commands — Loop phases
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, journalctl. Reference sites: Purple team loop (https://attack.mitre.org/resources/adversary-emulation-plans/); Elastic detection rules (https://www.elastic.co/guide/en/security/current/prebuilt-rules-management.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Roles
Red proposes TTP; blue owns detection content; stakeholders approve scope — no unilateral prod changes.
Document disagreements professionally — gaps are data, not insults.
3. Refused shortcuts
Disabling AV/EDR to 'complete' emulation, log clearing to hide misses, testing on prod without change window — refused.
Purple improves detections — not attacker tradecraft catalogs for strangers.
4. What you ship: purple loop one-pager
Loop diagram + roles + success metric + next re-test date on $LAB_RT.
5. What you record before the next lesson
Purple loop one-pager path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Turn off lab SIEM so red can claim win without detection map.
- Right: Purple loop one-pager written. Next: Evidence for Blue.
Mission: purple loop one-pager
1) Draw plan→execute→review→tune→retest. 2) Assign red/blue roles. 3) Define success metric. 4) Schedule re-test on $LAB_RT.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Who owns rule deploy in my lab bench?”
APPLY: Purple loop success:
APPLY: True or False: Red wins by silencing blue logs.
APPLY: After missed alert: