defense-purple-teamlisted

# Purple teaming (emulate → detect → improve) ## When it applies You want to *measure and improve* detection, not just find bugs. Purple teaming runs known attacker techniques in a controlled way and checks whether each is prevented, detected, and responded to — closing the loop between offense and defense. ## Why it works Detections are only real if they fire on the actual technique. Emulating each technique and watching the telemetry proves coverage, exposes blind spots, and produces tuned detections — turning "we think we'd catch it" into evidence. ## Method 1. **Pick techniques from real risk**: map to MITRE ATT&CK, prioritized by your threat model (→ `defense-threat-modeling`) and recent red-team/pentest findings. 2. **Emulate safely**: run controlled tests — **Atomic Red Team** (per-technique atomics) or **CALDERA** (chained) in a lab/segmented env. One technique at a time, documented. 3. **Observe the pipeline**: for each, check — was it *prevented* (EDR/control)? *logged* (right source/fields)? *detected* (alert fired)? *responded* (triaged in time)? Record the gap at each stage. 4. **Fix the gaps**: add/tune detections (→ `defense-detection-sigma`), fix logging coverage, harden the control (→ `defense-hardening-baseline`), and improve the runbook. 5. **Re-test** to confirm the detection fires and is low-FP; track ATT&CK coverage over time. ## Anti-patterns - Running noisy tools blindly instead of specific, mapped techniques — you learn nothing measura