Configurable role profile
Turn every technique into a measurable control improvement.
Purple Team pathways connect offensive observation to defensive validation. Practitioners map emulated techniques to expected telemetry, verify whether a detection fired and whether an analyst could act on it, identify the gap precisely, tune the control, and retest to confirm the improvement holds. The output is not a score but a validated change: a tuned rule, a closed gap, and evidence that the control now behaves as intended.
CLIP · Purple Team role profile
Illustrative view- 01 · Mission outcomeConnect offensive observations to defensive validation, remediation and verified improvement.
- 02 · CompetenciesTechnique mapping · Control validation · Detection tuning · Gap analysis
- 03 · Exercise activityDetection coverage sprint
- 04 · EvidenceTechnique-to-detection map with expected and observed telemetry
Team-colour terminology varies by organization
Mission intent
The role's purpose and its boundaries.
Connect offensive observations to defensive validation, remediation and verified improvement.
Core competencies
What this pathway develops.
Competencies are versioned and mapped to organizational, NICE, relevant SKKNI or custom frameworks without duplicating the underlying evidence.
- 01Technique mapping
- 02Control validation
- 03Detection tuning
- 04Gap analysis
- 05Facilitation
- 06Retest
Learning pathway
Progressive difficulty, evidence at every step.
- 01FoundationStructured learning and prerequisites.
- 02Guided labSupervised practice with checkpoints.
- 03Team labCoordination and handoffs within the role.
- 04Integrated exerciseMulti-team scenario under exercise control.
- 05AssessmentObserved performance and assessor adjudication.
In sequence: Foundation knowledge leads into a guided laboratory, then a team laboratory, then an integrated multi-team exercise, and finally an assessment that produces competency evidence.
Representative scenarios
How the pathway is exercised.
Detection coverage sprint
Working a technique set end to end and closing the gaps it exposes.
Assumed-breach validation
Verifying that post-compromise activity is observable and actionable.
Control-regression test
Confirming that previously closed gaps have not reopened after change.
Tools and environments
Capability categories, not a tool list.
Specific tooling is selected per deployment after security, licence and air-gap review. The categories below describe what the pathway needs to work.
- Technique emulation and mapping workspaces
- Detection engineering and validation tooling
- Coverage and gap analysis views
Evidence of competence
What observable behaviour supports readiness.
A readiness claim for this role must trace back to these artifacts. Evidence freshness is tracked separately from current competence, so an expired record never silently counts as a current one.
How readiness is calculated- Technique-to-detection map with expected and observed telemetry
- Gap finding with supporting evidence
- Tuned rule and its version
- Retest result confirming the change
- Improvement action with a named owner
Collaboration
Upstream and downstream handoffs.
No role operates alone. These are the relationships that make this pathway useful to the wider mission.
Sits between Red and Blue Team pathways as the validation loop
Feeds verified gaps to engineering through Orange Team
Reports coverage posture to Gold Team for prioritisation
Metrics
Operational and learning measures.
What the platform can measure for this role. Targets are baselined with each organization rather than claimed in advance.
- Percentage of emulated techniques detected and correctly triaged
- Unresolved control gaps
- Time from gap identification to verified retest
Map your roles to CLIP.
We will work from your approved role definitions and competency framework, not from ours.