Purple team · MITRE ATT&CK · runs in your browser
Purple Team Coverage Tracker
Tick the ATT&CK techniques your team exercised and record what blue saw. You get coverage by tactic, a gap list and a report to share.
Coverage by tactic
Score per tactic: alerted = 100, logged only = 50, not seen = 0, averaged over the techniques you exercised. Green 75+, amber 40–74, red below 40, grey not tested. Click a tactic to filter.
Gaps, most urgent first
Mark techniques as exercised and record what blue saw to see gaps here.
Add a technique
Saved in this browser only. Nothing is uploaded.
How to use it
- After each technique in an exercise, tick Exercised and record Logged, Alerted and Blocked.
- Enter the minutes from execution to a person acting on it, and set your response target above.
- Give every gap an owner and a next action, then re-test it in the next exercise.
- Export Markdown for the report or CSV for your tracker.
Techniques are listed by MITRE ATT&CK Enterprise ID and name only, linked to attack.mitre.org. This tool contains no attack procedures.
Questions
What is purple teaming?
Purple teaming is security testing in which the red team (offence) and blue team (defence) work together in real time. Red runs an announced attacker technique, usually mapped to MITRE ATT&CK; blue checks whether it was logged, whether an alert fired and whether it was blocked; and both fix the gaps and re-test. The aim is measurable improvement in detection and response, not a win or a loss.
What does this tracker record?
For each ATT&CK technique you exercised: whether it was logged, alerted on and blocked, how many minutes it took for someone to respond, who owns the fix and the next action. It starts with 27 common Enterprise techniques, listed by ID and name only, and you can add any other technique ID.
How is the coverage score worked out?
Each exercised technique scores 100 if an alert fired, 50 if it was only logged and 0 if it was not seen. The score for a tactic is the average over the techniques you exercised in it. Blocking is shown separately, because a blocked attempt that nobody sees is still a detection gap.
What counts as a gap?
A technique you exercised that was not logged or alerted on, one that was logged but raised no alert, or one that alerted but took longer than your response-time target. Gaps are ordered with no visibility first, and the list notes any gap without an owner or next action.
Is my data uploaded?
No. The tracker runs in your browser and keeps your entries in this browser only. Export the Markdown or CSV report to share it or keep a record.
How is this different from the Purple Team Exercise Planner?
The planner helps you choose a threat and build the test cards and agenda before an exercise. This tracker records the results across exercises, technique by technique, so you can see coverage by tactic and track gaps to closure.
Keep going
- Purple Team Exercise Planner: pick a threat and get the ATT&CK test cards and agenda.
- Log triage labs: practise spotting the attack in the logs.
- Cyber War Room: lead a full incident as the CISO.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.