Phase 12: Reporting, Purple Teaming, and Staff Communication
Operation Cedar Lattice — Final Delivery Target: Meridian Freight International | Actor Emulated: FIN-LATTICE Phase 12 closes the engagement. The binary is delivered; the adversary is attributed; the detections are validated. Now the team writes the report, runs the purple team replay, and briefs leadership. This phase is the product.
Safety Statement
This phase contains no offensive content. All labs operate on structured data (Python dicts representing findings and exercise results). No exploitation, no payloads, no network traffic. The phase is entirely professional delivery: writing, metrics, and communication.
Table of Contents
Why This Phase
The report is not a formality — it is the engagement's only durable output. Every escalated privilege, every pivoted segment, every bypassed control disappears when the team disconnects. What remains is the report. If the report is weak, the engagement was weak, regardless of what the team achieved technically.
Purple teaming closes the loop that traditional red teaming leaves open. A finding in a PDF that no blue-team analyst ever validates is a finding that may never get fixed. Purple teaming turns "we found it" into "we confirmed the detection fires" — the only outcome that actually reduces organizational risk.
Staff communication — translating T1190 / CVSS 9.8 into "an attacker who finds this endpoint can own your domain controller in 15 minutes and walk out with 42TB of customer shipping data subject to GDPR Article 83 fines" — is what converts a technical exercise into executive action. Without it, even a perfect report gathers dust.
Learning Objectives
- Structure a Mandiant-style engagement report with all eight required sections.
- Apply the nine-field finding quality bar so every finding is self-contained and actionable.
- Map findings to ATT&CK sub-techniques and explain the Detection-Gap Matrix.
- Execute a purple team replay loop: execute → validate → gap-close → re-execute.
- Compute and interpret precision, recall, F1, MTTD, and detection coverage % from purple team exercise data.
- Use VECTR to track technique coverage across quarters and trend improvement.
- Translate technical findings into business risk language appropriate for a CFO or board-level briefing.
Cedar Lattice Artifact
At the end of Phase 12 the Cedar Lattice team delivers:
Final Engagement Report — Meridian Freight International
Operation Cedar Lattice
Red Team Assessment Report
Client: Meridian Freight International
Engagement Window: [fictional dates]
Classification: CLIENT CONFIDENTIAL
Sections:
1. Executive Summary (2 pages)
2. Engagement Overview (scope, RoE, team)
3. Attack Narrative (Cedar Lattice chronological timeline)
4. Findings (8 findings, prioritized by CVSS + business risk)
5. Detection-Gap Matrix (23 techniques tested; 9 undetected)
6. Remediation Roadmap (30/60/90-day plan)
7. Purple Team Replay Results (VECTR export)
8. Appendices (redacted evidence)
The executive summary leads with: "FIN-LATTICE successfully compromised Meridian Freight's domain controller within 6 days of initial access, gaining read access to all shipping manifest databases. No alert fired during the dwell period. This report documents the attack path, identifies nine detection gaps, and provides a 90-day remediation roadmap."
Labs
| Lab | Topic | Key Skills |
|---|---|---|
| lab-01-report-quality-linter | Report Finding Linter | Nine-field completeness check, severity validation, ATT&CK ID format, detection rule type, remediation timeline |
| lab-02-purple-team-coverage | Purple Team Coverage Scorer | Precision, recall, F1, detection coverage %, top gaps, FP rate, exercise summary |
How to Run
Prerequisites
pip install pytest
Lab 1 — Report Quality Linter
cd lab-01-report-quality-linter
# Stubs: expect NotImplementedError
pytest -q
# Reference solution: expect all pass
LAB_MODULE=solution pytest -q
Lab 2 — Purple Team Coverage Scorer
cd lab-02-purple-team-coverage
# Stubs: expect NotImplementedError
pytest -q
# Reference solution: expect all pass
LAB_MODULE=solution pytest -q
Navigation
- Previous: Phase 11 — Threat Intelligence Integration
- This is the final phase of the Red Team Engineer curriculum.
Operation Cedar Lattice — Cedar Lattice Phase 12 of 12.