What is purple teaming and how do you run a purple team exercise?
Short answer
Purple teaming is collaborative rather than adversarial: the red side executes specific, agreed TTPs (often mapped to MITRE ATT&CK) while the blue side watches their telemetry in real time to confirm whether each technique is logged, alerted, and detectable. You measure detection coverage technique-by-technique, tune detections and close gaps immediately, then re-test. The deliverable is improved, measurable detection — not a list of who 'won.'
Purple teaming exists because adversarial red-versus-blue exercises often end with a report nobody operationalizes. Interviewers ask about it to see whether you understand that the point of offense in a mature program is to make defense measurably better, not to score points.
Collaborative, not adversarial
In a classic red team, the blue team is kept in the dark to test detection realistically. In a purple team, the two sides work in the same room (or call). The red side executes a known, agreed technique; the blue side watches their SIEM, EDR, and logs in real time to answer one question per technique: did we see it, did we alert on it, and could we have responded?
The loop
- Plan. Select techniques to test, almost always mapped to MITRE ATT&CK so coverage is structured and comparable over time. Threat intelligence guides which actor's TTPs to prioritize.
- Execute. Red runs each technique deliberately — frameworks like Atomic Red Team or Caldera give repeatable, atomic tests.
- Observe. Blue checks whether the activity produced telemetry, whether a detection fired, and how loud or quiet it was.
- Improve immediately. Where there's a gap — no log, no alert, or a false negative — blue writes or tunes a detection on the spot.
- Re-test. Re-run the technique to confirm the new detection actually fires.
Why it works
It separates two often-confused things: visibility (is the activity even logged?) and detection (does something alert?). A technique can be fully logged yet completely undetected. Purple teaming surfaces exactly which ATT&CK techniques fall into each bucket, producing a concrete coverage map.
What interviewers look for
They want the collaborative framing, MITRE ATT&CK as the common language, the log-versus-alert distinction, and an outcome measured as improved detection coverage that persists after the exercise — not a scoreboard.
Likely follow-ups
- How does MITRE ATT&CK help structure a purple team engagement?
- What's the difference between a detection that fires and one that's merely logged?
- How do you turn purple team results into lasting detection coverage?