The Full Purple Juice, Not the Watered-Down Stuff

The talk covers a six-week purple team engagement run for a real client, the National Motor Freight Traffic Association. The speakers took on cyber threat intelligence, red team and blue team roles, working inside the production environment under a strict rule of no new technology spending, so only existing controls could be tuned.

The first week set a baseline with a simple campaign that went almost entirely unseen. Each later week emulated a different threat group of rising sophistication, drawn from public adversary emulation plans. For each one the team enabled more Sysmon event types, forwarded logs to the existing SIEM, and built correlation logic so that chains of behavior triggered alerts. Testing also exposed gaps such as outbound RDP and standard users in an enterprise admin group, and a team that believed PowerShell was unused produced hundreds of alerts once it was monitored.

Detection rose from about 6 percent of tested behaviors at baseline to roughly 64 percent by the end. The speakers stressed that full coverage is unrealistic and that each organization should find its own natural detection rate. Practical takeaways include testing in production so controls reflect real conditions, involving people and process alongside technical checks, and measuring response times once alerts exist.