1---2name: purple-team-automation3description: Purple team automation skill that links offensive emulation (Atomic Red Team, Caldera, Stratus Red Team, Leonidas) with detection validation, telemetry-gap analysis, and continuous control testing. Use to design adversary emulation plans tied to MITRE ATT&CK, execute safe tests in lab or controlled environments, and produce evidence-backed detection coverage reports.4---56# Purple Team Automation78## Authorization Boundary910- Run only in environments with written approval, change windows, and rollback owners.11- Tag every test with a unique `campaign-id` for cleanup and timeline reconstruction.12- No data destruction, no real credential theft, no third-party services targeted.1314## Campaign Workflow15161. Pick an adversary or technique set with business relevance; cite ATT&CK IDs and known intrusion sets.172. Draft an emulation plan: prerequisites, steps, expected telemetry, success/fail criteria, cleanup.183. Execute with `invoke-atomicredteam`, `caldera` operations, `stratus`, or custom scripts in isolated runners.194. Capture telemetry across EDR, Sysmon, cloud audit, network, identity, and SIEM.205. Compare expected vs observed events; flag missing logs, parsing failures, and rule misses.216. File defensive backlog: new detections, tuning, telemetry enablement, and response runbook updates.2223## Coverage Scoring2425- `Prevented`, `Alerted`, `Logged-not-alerted`, `Missed`. Score by technique and by data source.26- Track time-to-detect and time-to-contain per test.27- Maintain a heatmap over ATT&CK with last-validated date and confidence.2829## Output Contract3031- `plans/<campaign>.md`: technique list, steps, expectations.32- `runs/<campaign>/`: command logs, artifacts, screenshots, raw telemetry.33- `coverage.csv`: technique × status × evidence × backlog ticket.34- `report.md`: executive coverage, top gaps, prioritized fixes with owners.
Masriyan