domains / families / security / performing-purple-team-atomic-testing

performing-purple-team-atomic-testing

separate

'Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam

When to use

• Validating detection coverage against specific MITRE ATT&CK techniques
• Running purple team exercises using Atomic Red Team test library
• Performing ATT&CK coverage gap analysis to identify blind spots in SIEM/EDR
• Building a detection validation loop: execute atomic test, check SIEM, tune rule, retest
• Generating ATT&CK Navigator heatmap layers for executive reporting
• Automating continuous atomic testing in CI/CD or scheduled pipelines
• Mapping threat intelligence reports to executable atomic tests

When not to use

• full-scope red team engagements requiring custom implants
• live adversary simulation beyond atomic tests

Skill page

Source