This workshop will go over the introduction of red/purple teaming, along with how individuals can emulate adversary actions, as well as track those actions across their enterprise, evaluating their detection coverage.

We'll first go over how a tool like Prelude Operator can be used to emulate these adversary actions, then learn how Security Onion can be leveraged to detect these actions and track our coverage across the MITRE attack framework.

Throughout the discussion the following tools will be introduced:

- Prelude Operator - autonomous red-teaming platform, creating adversaries to test detection

- Zeek - Policy-neutral NIDS

- Suricata - Signature-based NIDS

- Stenographer – Full Packet capture

- Playbook - Detection development

- ATT&CK Navigator - Track detection coverage

- Strelka - File analysis

- Osquery - Host-based monitoring

- Wazuh - HIDS