Blue team
purple team · purple teaming · defenders · defensive team · équipe bleue
The team that defends the information system day to day: monitoring, detecting attacks, responding to them and hardening configurations.
In practice
The blue team often brings together the SOC, system administrators and the incident response team. Against a red team, it plays its own part: spotting the intruder and containing them. Purple teaming is a collaborative format: attackers and defenders work side by side, technique by technique, to check live that an offensive action is actually detected, and to improve the detection rule when it is not.
Fictional case: during a purple team workshop, the red team replays five techniques taken from MITRE ATT&CK. Three are detected in under ten minutes; two go unnoticed. The SOC writes two new rules that same afternoon, and the next exercise confirms they work.
