Repository navigation
docs(exercises): a record and template for purple-team exercises - #1191
Merged
Merged
Conversation
docs/exercises/ holds one dated file per exercise against the lab domain: techniques with ATT&CK IDs, the detections expected before the run, what Wazuh, Velociraptor, Zeek, Suricata and Loki actually saw, and the gaps that open issues. Files are records like the changelog, describe activity rather than payloads, and stay inside the lab. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx
There was a problem hiding this comment.
🟡 Changes recommended
The template contains a broken ADR-0083 link that should be corrected before approval.
1 open finding
What changed in this PR
Adds immutable purple-team exercise records and a reusable exercise template.
Changes:
- Documents exercise rules, evidence sources, and indexing.
- Adds a structured exercise template.
- Updates repository guidance and layout.
| File | Description |
|---|---|
README.md |
Lists the exercises directory. |
docs/exercises/README.md |
Defines exercise-record conventions. |
docs/exercises/TEMPLATE.md |
Provides the exercise format. |
CLAUDE.md |
Classifies exercises as immutable records. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
6 of 7 tasks
The template pointed at 0083-give-the-lab-domains-... ; the accepted file is 0083-give-the-lab-domain-its-... . Every exercise copied from the template would have carried the broken link. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx
Gerrrt
pushed a commit
that referenced
this pull request
Oct 14, 2026
Copilot's review of #1192. ADR-0014 names the C2 operator's interface as reached from a Hicks workstation over 50 -> 30, and ADR-0091 makes garuda defensive-only, so the console is driven from Hicks, not the analyst workstation. The two docs/exercises/ links are dropped to prose so this ADR does not depend on the still-open #1191 and never carries a broken link on main. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx
Gerrrt
added a commit
that referenced
this pull request
Oct 14, 2026
* docs(adr): ADR-0095, run Sliver as the range C2 on the attack VM ADR-0007 and ADR-0017 name a C2 on ifrit without choosing one. This picks Sliver as the default framework, run on the attack VM inside the range so its callbacks cross the segment the SOC and Zeek watch, with Mythic named as a per-exercise fallback. The channel is chosen to be representative and well-signatured so a missed detection is a real gap, not an artifact of an exotic tool. No new firewall rule; nothing reaches the house. Refs #421. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx * docs(adr): keep C2 operator on Hicks, drop the unmerged exercises links Copilot's review of #1192. ADR-0014 names the C2 operator's interface as reached from a Hicks workstation over 50 -> 30, and ADR-0091 makes garuda defensive-only, so the console is driven from Hicks, not the analyst workstation. The two docs/exercises/ links are dropped to prose so this ADR does not depend on the still-open #1191 and never carries a broken link on main. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Docs only. Adds
docs/exercises/, a place to record purple-team exercises against the lab domain:docs/exercises/README.mdsets the rules:security.md's publishing rules applyingIt also lists where the evidence comes from (Wazuh, Velociraptor, Zeek, Suricata, the lab's Loki) and holds an index of past exercises, empty for now.
docs/exercises/TEMPLATE.mdhas these sections: objective; scope, including the time window and which deliberate weaknesses were switched on (ADR-0083); techniques; the detections expected, written before the run; what was observed; gaps and fixes; lessons.README's repository layout gains the folder.
CLAUDE.mdnow lists exercise files as records.Why
The repository has a SOC and a lab domain built to be attacked, and the range on
ifritis next. Until now there was nowhere to write down whether an attack was detected. Recording the expectation before each run and the result after it turns the lab into evidence of detection coverage that can be measured over time.Blast radius
None. This changes documentation only.
secrets/*.sops.yamlVerification
scripts/check_docs.pypasses:docs OK — 158 Prometheus + 20 Loki rules, 8 dashboards, 156 panels, 11 assertionsscripts/lint.shpasses, but 12 of its checks were skipped because there's no Docker here, including editorconfig, shellcheck and actionlint. I checked editorconfig's rules on the new files by hand: no trailing whitespace.markdownlint-cli2reports 0 errors on all four changed Markdown files. Every relative link target exists.🤖 Generated with Claude Code
https://claude.ai/code/session_01A4769sNhNE79DH3SBN4YXx
Generated by Claude Code