A Northgate SOC purple-team exercise riding the validation rail through eight stations — plan, emulate, detect, measure, gap, improve, automate and report. Benign, authorized atomic tests in the team's own lab range record a distinct outcome per technique: PowerShell and obfuscation are rule gaps, data encryption for impact is a data gap, inhibit recovery is covered. An ATT&CK heatmap reports an honest 57 percent strict coverage instead of a 95 percent vanity number, and a gap is closed by a new Sigma rule re-tested against the exact same technique until the SIEM alert fires.

CY-MID-066Mid Level · Purple Teaming

Purple Teaming & Detection Validation — The Validation Rail

A hands-on mid-level course that proves your detections work by testing them safely. Work the validation rail - eight stations: Plan, Emulate, Detect, Measure, Gap, Improve, Automate, and Report - running authorized ATT&CK-based emulation against your own environment and closing detection gaps. Strictly defensive and authorized. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Plan authorized, ATT&CK-based adversary emulation safely.
Emulate techniques and check whether detections fire.
Measure coverage, find gaps, and improve detections.
Automate continuous validation and report progress honestly.

Price:৳8,000