Purple Team Exercise Framework (PTEF)

The Purple Team Exercise Framework (PTEF) is the industry standard methodology for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence (CTI), Red Teams, and Blue Teams.

Purple Team Exercises are an efficient method to test, measure, and improve your organization's resilience to real cyber attacks. The framework covers:

• Purple Team Exercises - Ad-hoc collaborative exercises
• Operationalized Purple Team - Continuous virtual team effort
• Dedicated Purple Team - Dedicated staff roles

What's New in v4

PTEFv4 is a comprehensive overhaul focused on practitioner usability:

• Quick-Reference One-Pagers - Printable single-page guides for use during exercises
• Improved Documentation - Streamlined navigation, fixed errors, better organization
• Cloud & Identity Coverage - Cloud environments, identity providers, and modern infrastructure scoping
• AI/ML Threat Guidance - MITRE ATLAS, OWASP LLM Top 10, and AI/ML attack surface coverage
• Detection Engineering Expansion - Detection-as-Code, Sigma rules, CI/CD deployment, detection lifecycle
• ATT&CK v18 Alignment - Updated to Detection Strategies + Analytics terminology
• Broadened Tool Ecosystem - SCYTHE, MITRE Caldera, Atomic Red Team, and The C2 Matrix references
• Continuous Purple Teaming - Automated regression testing, BAS integration, validation metrics
• Remote/Hybrid Exercise Guidance - Detailed guidance for remote and hybrid exercise logistics
• Contributor Guidelines - Clear process for community contributions
• PDF Generation - All documentation available in PDF format

Documentation

Read the Full Framework (PTEFv4) - The complete methodology including:

• Executive Summary & Definitions
• Goals and Objectives
• Industry & Regulatory Frameworks
• Roles and Responsibilities
• Planning Phases
• Cyber Threat Intelligence Process
• Exercise Execution Flow
• Lessons Learned
• Purple Team Maturity Model (PTMM)
• FAQ

Download: PTEFv4.pdf

Quick-Reference Guides

Printable one-page guides for use during exercises are available in the one-pagers folder:

Templates

Templates for running Purple Team Exercises are available in the templates folder:

• Purple Team Exercise Template (.docx)
• TTP Mapping Template (.xlsx)
• Emulation Plan Template (.md)

Version History

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines on how to submit pull requests, report issues, and suggest improvements.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

PTEF was created by SCYTHE and has been used by countless enterprises, consulting companies, and managed service providers worldwide. Thank you to all contributors who have helped make this the industry standard for Purple Team Exercises.

---

Repository: github.com/scythe-io/purple-team-exercise-framework