Purple team testing tools and frameworks

Editorial teamLast verified: 4 Nov 2026Implementation

Purple team work uses MITRE ATT&CK to name techniques, tools such as Atomic Red Team or Caldera to execute them, VECTR to track results and Sigma to write detection rules. Breach and attack simulation platforms automate part of this. None of them replaces a person who decides what to test and why.

What tools are used?

Job	Common choice	Note
Name the technique	MITRE ATT&CK	A public knowledge base of adversary tactics and techniques
Run small tests	Atomic Red Team	A library of small tests mapped to ATT&CK techniques
Run chains	Caldera	An open-source platform for automated adversary emulation
Track results	VECTR	Records assessments, test cases and outcomes
Write detections	Sigma	A generic rule format that converts to many SIEM query languages
Repeat at scale	Breach and attack simulation (BAS) platforms	Commercial products that run known techniques on a schedule

How is ATT&CK used?

As a shared vocabulary. A scenario is described as techniques, each technique is tested, and results are shown as covered, detected or missed. Group-IB says its scenarios are mapped to MITRE ATT&CK techniques, and the Mandiant datasheet says its assessment aligns with the framework. Not every provider names a framework; Paranoid Security’s cyber exercises page does not, while its red teaming page cites the ATT&CK matrix. See the Mandiant profile and the Group-IB profile.

BAS versus manual?

BAS runs known techniques consistently and cheaply, so it suits repeat checks. Manual work suits judgment: choosing scenarios from threat intelligence, adapting to what the defenders see, and explaining why something was missed. The continuous vs one-off guide covers when to combine them.

What should I ask a provider about tools?

Which tools will run in our environment, and who approves them?
Are techniques mapped to ATT&CK in the report?
Where are results tracked, and do we get the data?
Are detection rules delivered in a format we can import, such as Sigma?

Many providers publish no tools list. Group-IB, Mandiant and Wattlecorp name none, so ask. For how a tool fits the sequence, read the step-by-step guide.

Frequently asked questions

Which tool tracks results?

VECTR is an open-source tool built to record purple team assessments and outcomes. Spreadsheets also work for a small exercise.

Can breach and attack simulation replace human-led work?

It can repeat known techniques at low cost. It does not choose scenarios from your threat picture or tune your detections for you, so most programmes use it alongside people.