Red teams think like attackers, blue teams think like defenders, and the best results come when they work together. This red team training teaches adversary simulation concepts and shows how to turn offensive findings into better detection and response.
Who should attend
- Experienced penetration testers moving toward red teaming
- SOC analysts, detection engineers and threat hunters
- Security team leads planning purple team exercises
- Incident responders who want to understand attacker behavior
Prerequisites
This is an intermediate-level program. Participants should have hands-on experience in penetration testing, SOC operations or incident response, and be comfortable with Windows and Active Directory fundamentals. Penetration testers without Active Directory experience can start with our Network Penetration Testing Training.
What you will learn
- Red team, purple team and penetration testing: goals and differences
- Planning an engagement: objectives, rules of engagement and safeguards
- Threat-informed adversary emulation
- The MITRE ATT&CK framework as a shared language
- Attack lifecycle concepts: initial access to objective
- How defenders see attacker activity: logs, telemetry and alerts
- Running a purple team exercise step by step
- Measuring detection coverage and finding gaps
- Writing and tuning detection rules
- Reporting, debriefs and building a continuous improvement loop
Hands-on labs
Participants take part in guided exercises in a lab environment, with both offensive and defensive perspectives. Each attack technique is executed, observed in the defenders’ logs and alerts, and then used to write or tune a detection.
What you receive
- Course materials and lab access
- Templates for planning and reporting purple team exercises
- A certificate of attendance
Frequently asked questions
Learn to attack, detect and improve
Contact us for dates, pricing and corporate options.
