Question

A security operations manager wants to validate whether the SOC can detect the specific TTPs used by a threat actor known to target their industry. The red team has already demonstrated it can achieve initial access and lateral movement, but the manager is frustrated that detection engineering never improved afterward because the red team report only listed successful compromises without SOC visibility details. Which approach BEST addresses this gap going forward?

Accepted Answer

Conduct a purple team exercise where red team executes mapped ATT&CK techniques collaboratively with blue team, recording detection/alerting outcomes per technique to drive detection engineering

Answer

Increase the frequency of unannounced red team engagements so the SOC has more opportunities to encounter and respond to realistic attacks

Answer

Replace the red team engagement with an automated vulnerability scan mapped to CVEs the threat actor is known to exploit

Answer

Require the red team to submit a full attack narrative to the SOC after each engagement so analysts can retroactively write detection rules