Skip to content

Testcase Data Capture

This screen (/testcase/<testcaseid>) is the core of PurpleOps, allowing red / blue teams to enter their relevant data for each testcase.

Tip

Hit the i icon left of the testcases's name to see Mitre's description and advice for the testcase, applicable SIGMA rules, and references.

Tip

Use the Go dropdown right of the testcase end time to quickly jump to another testcase without returning to the assessment screen.

Red Side

Note

Only Admin and Red users can perform these functions.

The red team enters / edits data pertaining to the testcase's:

  • Mitre ID
  • Name
  • Tactic
  • Start / end execution time (as populated via the start / stop button)
  • Visibility (toggled via the "eye" button)
  • Source(s)
  • Targets(s)
  • Tools(s) used
  • Objective (what's the aim of the testcase?)
  • Actions (what command was run or manual action performed?)
  • Notes (e.g. did successful execution require obfuscation?)
  • Evidence (intended to include screenshots, logs and tools executed)
    • Evidence captions (images only)

Blue Side

Note

Only Admin, Red and Blue users can perform these functions.

The blue team enters / edits data pertaining to the testcase's:

  • Prevention status
  • Detection status
    • Alert generated
      • Alert severity
    • Logged status (inferred Yes if there was an alert)
  • Priority
    • Focus
    • Urgency
  • Applicable controls
  • Tags
  • Notes (e.g. alert IDs, log permalink URLs, commentary)
  • Evidence (intended to include alert screenshots, raw log files...)
    • Evidence captions (images only)

Managing Sources / Targets / Tools / Controls / Tags

Under each dropdown is a Manage button that opens a modal allowing for the specification of each asset. Changes in the manage modal are high-level to the assessment, not per-testcase. Per-testcase applicable controls are instead chosen in the dropdown.

Saving

The red "return" arrow returns to the assessment screen without saving. The green "tick" button saves the testcase and does not return to the assessment screen. The navbar return button also does not save.