Purple Team · Detection Engineering

Purple Range

Live-fire detection engineering. Run a real attack, hunt the fresh telemetry in a live SIEM, and write a Sigma rule that is graded server-side — cheat-proof, with MTTD and ATT&CK coverage.

Request a demo

The detection loop

Every technique walks the same loop — attack, telemetry, hunt, detect, score.

Launch the attack

Trigger a real attack stage in the live box.

Fresh telemetry

Real events land in the live SIEM — not canned logs.

Hunt

Investigate the SIEM to separate signal from noise.

Write a Sigma rule

Author a detection that catches the technique.

Graded, cheat-proof

Scored server-side by F1 against a hidden corpus.

What makes it different

Not a quiz about detection — a range where you build and prove it.

Live attack, real telemetry

Each stage runs a real attack in the box, so you hunt authentic events with authentic noise — never a static, memorised dataset.

Cheat-proof grading

Your Sigma rule is scored on the server against a held-out corpus of malicious variants and benign decoys. Lazy, over-broad rules fail by design.

MTTD & MTTR

Every technique is timed: mean-time-to-detect and respond, so skill becomes a number leaders can track.

Multi-stage kill chains

Campaigns chain techniques end to end. Pass one stage to unlock the next, just like a real intrusion.

ATT&CK coverage

Techniques map to MITRE ATT&CK tactics, building a live detection-coverage matrix across your team.

Manager view

Team coverage, per-technique pass rates and MTTD roll up for leaders — a defensible readiness picture.

A live detection-coverage matrix

Every technique your team passes lights up a cell against the MITRE ATT&CK tactics. Over time the matrix fills in — and the dark columns show exactly where your detection gaps are, technique by technique.

Mapped to MITRE ATT&CK tactics
Per-technique pass rate across the team
Gap report for untouched tactics

Live-fire campaigns

Real intrusions across Linux, web, cloud and Windows — each a chained kill chain.

SSH Brute Force Web Intrusion Web Exploitation DNS C2 & Exfiltration Network Recon Linux Privilege Escalation Linux Post-Exploitation Node2Shell Ransomware Impact AWS Cloud Breach Windows AD Kill Chain Windows Post-Exploitation

For managers & CISOs

Turn detection skill into a readiness picture you can report against.

Detection coverage

What share of ATT&CK techniques your team can actually detect.

Team MTTD / MTTR

How fast the team detects and responds, trended over time.

Gap report

Which tactics have zero coverage — where to invest next.

Prove your detections, don't assume them

See Purple Range live: a real attack, a real SIEM, and a Sigma rule scored in front of you.

Request a demo