agentleFS
Sign inStart free
MasriyanMasriyan/gemini-security-skills/skills/purple-team-automation/SKILL.md

purple-team-automation

Skill4 starsChanged 5 months agoMITView on GitHub

Purple team automation skill that links offensive emulation (Atomic Red Team, Caldera, Stratus Red Team, Leonidas) with detection validation, telemetry-gap analysis, and continuous control testing. Use to design adversary emulation plans tied to MITRE ATT&CK, execute safe tests in lab or controlled environments, and produce evidence-backed detection coverage reports.

We split this skill into the rules it gives an agent

2 rules. About 0 are common, 2 are distinctive, and 0 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈2

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Run only in environments with written approval, change windows, and rollback owners.

    line 10
  2. Distinctive:

    No data destruction, no real credential theft, no third-party services targeted.

    line 12

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Purple Team Automation

Authorization Boundary

  • Run only in environments with written approval, change windows, and rollback owners.
  • Tag every test with a unique campaign-id for cleanup and timeline reconstruction.
  • No data destruction, no real credential theft, no third-party services targeted.

Campaign Workflow

  1. Pick an adversary or technique set with business relevance; cite ATT&CK IDs and known intrusion sets.
  2. Draft an emulation plan: prerequisites, steps, expected telemetry, success/fail criteria, cleanup.
  3. Execute with invoke-atomicredteam, caldera operations, stratus, or custom scripts in isolated runners.
  4. Capture telemetry across EDR, Sysmon, cloud audit, network, identity, and SIEM.
  5. Compare expected vs observed events; flag missing logs, parsing failures, and rule misses.
  6. File defensive backlog: new detections, tuning, telemetry enablement, and response runbook updates.

Coverage Scoring

  • Prevented, Alerted, Logged-not-alerted, Missed. Score by technique and by data source.
  • Track time-to-detect and time-to-contain per test.
  • Maintain a heatmap over ATT&CK with last-validated date and confidence.

Output Contract

  • plans/<campaign>.md: technique list, steps, expectations.
  • runs/<campaign>/: command logs, artifacts, screenshots, raw telemetry.
  • coverage.csv: technique × status × evidence × backlog ticket.
  • report.md: executive coverage, top gaps, prioritized fixes with owners.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free