Maximizing the Value of Attack Detection Tooling with Atomic Purple Teaming

SANS PenTest HackFest 2022

Speaker: Alfie Champion, Adversary Emulation Manager, TP ICAP

In the early stages of a SOC's development, it is not uncommon to see tooling installed and running in an untuned state. A scenario in which analysts are unfamiliar with new security portals, response workflows, and where alert fatigue can easily creep in.

This talk initially outlines what atomic purple teaming is, and leverages real-world experience to demonstrate how it can provide the means to train the SOC, …

adversary adversary emulation alert alert fatigue analysts attack detection development emulation experience hackfest manager pentest purple response sans scenario security soc state tooling uncommon value workflows world