Red, blue and purple team validation

Agree on the work and who can stop it

Record the systems, identities, environments, dates and permitted techniques. Identify third-party dependencies and obtain the necessary authorization before including them. Establish who can stop the exercise and how the team will distinguish its activity from an unrelated incident.

ATT&CK can describe relevant behavior, but it is not a requirement to execute every technique. Choose actions that fit the assets, exposure and defensive questions being examined. Marking a technique as covered does not establish that every related attack path is controlled.

Follow an unexpected role assignment through the response

In a fictional purple-team exercise, the organization wants to know whether an unexpected privileged role assignment will be detected and investigated. The team uses an approved test identity and a nonproduction target, makes the agreed change and records the timing of the defensive steps.

Check whether the event is generated, collected, interpreted, routed and acted upon. If it reaches the log store without producing an alert, investigate detection. If an alert exists but no owner responds, investigate the operating process. Both prevent the intended response, but they need different corrections.

Retain the rules and the expected result

The exercise plan needs to explain what can be done and what will count as a result. It should also specify what happens if the test reaches a stopping condition.

• Objective: specific control or response question and expected result.
• Scope: owned targets, approved accounts, exclusions and time window.
• Execution limits: permitted actions, load, data handling and stop conditions.
• Coordination: controller, emergency contact and deconfliction procedure.
• Evidence: timestamps, action identifiers, telemetry and response observations.
• Closure: cleanup, restored access, remediation owner and retest criteria.

Verify cleanup, then repeat the complete path

Remove test privileges, accounts, files and temporary configuration. Compare the final state with the agreed baseline, and remove unnecessary sensitive material from retained evidence. The exercise ending does not itself show that the temporary access was removed.

After a correction, retest the failed stage and follow the whole path again. A telemetry or workflow change could have introduced a different failure. Confirm the intended response and check that ordinary administrative activity is handled appropriately.

State what passed and what remains untested

A successful exercise supports the tested behavior, configuration and time window. It does not establish that no other path exists. Keep the preconditions and untested variants beside the outcome so the organization can decide what needs further testing, engineering work or operational preparation.