Attack and defence in the same room
Purple teaming is a collaborative exercise. Our operators run attack techniques one at a time while your defenders watch their tools. For every technique we check together: was it logged, did it alert, and would the analyst know what to do? Gaps are fixed during the exercise, not months later.
How it differs from red teaming
| Red team | Purple team | |
|---|---|---|
| Goal | Test whether a realistic attack goes unnoticed | Improve detection technique by technique |
| Your SOC | Unaware the test is running | Working alongside us |
| Output | Attack narrative and gaps | New and tuned detections, validated live |
| Best for | Mature teams testing their response | Teams building or tuning detection |
How it works
- Select techniques: we choose MITRE ATT&CK techniques that matter for your sector and your Microsoft stack, from phishing and token theft to credential dumping and ransomware behaviour.
- Run and observe: each technique is run in a controlled way while your team checks Defender XDR, Sentinel or your SIEM.
- Fix and re-run: missing telemetry, policies and analytics rules are fixed, then the technique is run again to confirm it is detected.
- Report: a coverage map showing what is detected, partly detected or missed, plus the detections and runbooks we built together.
Example techniques we test
| Area | What we run | What it should trigger |
|---|---|---|
| Identity | Password spray, risky sign-ins, suspicious inbox rules | Entra ID Protection risk, Defender for Cloud Apps alerts |
| Simulated phishing with links and attachments | Defender for Office 365 detonation, user report flow | |
| Endpoint | Credential access, suspicious PowerShell, persistence | Defender for Endpoint alerts, ASR blocks, automatic isolation |
| Active Directory | Reconnaissance, Kerberoasting, lateral movement | Defender for Identity alerts and honeytoken triggers |
| Ransomware behaviour | Mass file changes on test data, backup tampering attempts | Attack disruption, Sentinel incident and playbook |
Techniques run in a controlled way on agreed test machines and accounts, never with destructive payloads.
A typical exercise
- Preparation (about 1 week): pick techniques, agree test accounts and machines, confirm logging is on.
- Exercise days (2–5 days): run, observe, fix and re-run together, with your analysts in the room or on a call.
- Report (about 1 week later): a before and after coverage map, plus every new detection and runbook.
Many clients repeat the exercise each quarter or after major changes, so the coverage map shows progress over time.
What you need
Microsoft Defender XDR and/or Sentinel (or another SIEM), one or two analysts who can join the sessions, and a test device and account in production or a representative test environment.
See it in our lab
Many techniques are rehearsed first in the Kage Defender Lab, so the exercise in your environment is short and predictable.
Who it is for
Organisations running Microsoft Defender XDR or Sentinel that want to know what their tools actually catch, and SOC teams that want hands-on training against real techniques.