Purple team cyber range for hands-on SOC adversary emulation training
Build a purple-team cyber training range as a small 3B web application. The goal: give a SOC team a place to rehearse full-kill-chain adversary emulations against realistic telemetry, feel the consequences of bad or slow decisions, get AI-graded on hands-on detection writing, and track readiness over time. Trigger: primarily browser — a React app served on its own route (e.g. /cyber-range), space-authenticated. Plus one daily cron step that refreshes a threat-intel cache. What it should do Offer several adversary emulation campaigns based on real intrusion patterns (I used Octo Tempest, Midnight Blizzard, Volt Typhoon, FIN7, Bling Libra) plus a timed free-play SOC triage drill. Each campaign walks stage by stage through the kill chain. At each stage, show synthetic telemetry rendered as the console it would have come from (simulated Splunk / Defender / Falcon / Okta / cloud consoles — or whatever tooling your team runs), then make the trainee choose an action. One choice is optimal, some are partial, and at least one plausibly makes the breach worse and scores negative. Make it reactive: wrong or slow calls escalate the adversary, can branch the run into a harder recovery stage, and can destroy evidence needed later. Keep this consequence engine as its own data/logic module in the app. On detection-heavy stages, offer an optional hands-on challenge where the trainee writes a real SPL/KQL/Sigma detection and an AI step grades it on logic and coverage. Score accuracy plus MTTD/MTTR, then produce an after-action review that maps each decision to its MITRE ATT&CK technique, shows the adversary's reaction, and surfaces live ATT&CK detection guidance and any relevant known-exploited-vulnerability exposure. Build a per-operator readiness profile over time: progression level, ATT&CK coverage heatmap, and an AI coaching note that reads their history and says what to drill next. Add a manager command center: org-wide readiness, the cohort's weakest tactics, per-operator progress, and campaign assignment tracking (assign/unassign, completion derived from recorded runs). Let operators declare their own tech stack per category (SIEM, EDR, identity, SOAR, web gateway, email, cloud, exposure, network detection, virtualisation). Relabel every console and tool chip to their products while keeping query syntax authentic to the emulated source. Shape it like this One React step for the whole UI. It must render instantly and fetch everything from sibling API route steps — never sit downstream of a data-hydration step. Small single-purpose JSON API route steps (route_type = "api", each with an api.json): threat intel (read-only), scoreboard (GET leaderboard / POST record a run), operator profile, cohort aggregation, assignments, and tech-stack preference. Two AI steps, each a single model call behind its own route: one for readiness coaching, one for grading detection queries. Use Claude — or whichever model provider you prefer. One cron step (daily) that fetches and caches threat intel into a named volume; the intel API reads that volume read-only and falls back to a live fetch if the cache is cold. Persist state in named volumes with exclusive writers for the files that get updated in place (scores, assignments, stacks). Keep drafts isolated from live. Add a manual, no-route seeding step that writes a realistic synthetic dataset (a dozen operators, several weeks of runs, coherent ATT&CK technique IDs) so the scoreboard, readiness and command center views look lived-in for demos. Keep all routes space-authenticated. Use the authenticated-email header as the operator identity where available. Tools used: 3B React step, 3B TypeScript steps, 3B cron trigger, 3B named volumes, Anthropic Claude (claude-sonnet-4-5), CISA Known Exploited Vulnerabilities feed, FIRST EPSS API, MITRE ATT&CK Enterprise STIX bundle
What this prompt builds
A purple-team cyber training range that walks SOC teams through full kill-chain adversary emulations based on real threat actor campaigns. Trainees triage synthetic telemetry from realistic consoles, make time-pressured decisions that branch the scenario, optionally write and get AI-graded detection queries, and receive scored after-action reviews mapped to MITRE ATT&CK. Managers track org-wide readiness, cohort weak spots, and per-operator progression over time.
The problem
SOC teams need a safe environment to rehearse full kill-chain incident response against realistic adversary behavior without risking production systems or waiting for real breaches. Most training is passive or uses canned scenarios that don't reflect the branching, high-stakes decision-making of live incidents, and teams lack visibility into which MITRE ATT&CK techniques their analysts can confidently detect and respond to. This workflow delivers an interactive purple-team training range where practitioners step through real-world threat actor campaigns — Octo Tempest, Midnight Blizzard, Volt Typhoon, FIN7, Bling Libra — stage by stage, triaging synthetic telemetry rendered as authentic SIEM, EDR, identity, and cloud consoles customized to the team's actual tech stack. Trainees make time-pressured choices that branch the scenario, write detection queries that get AI-graded on logic and coverage, and see immediate consequences when decisions escalate the breach or destroy evidence.
Solution and impact
The range scores accuracy and speed (MTTD/MTTR), then produces an after-action review that maps every decision to its MITRE ATT&CK technique, shows how the adversary reacted, and surfaces live ATT&CK detection guidance and known-exploited-vulnerability exposure. Over time it builds a per-operator readiness profile — progression level, ATT&CK coverage heatmap, and AI coaching on what to drill next — while giving managers an org-wide command center that highlights the cohort's weakest tactics, per-operator progress, and campaign assignment tracking. Teams sharpen real-world detection and response skills, close ATT&CK coverage gaps, and gain measurable readiness data without waiting for production incidents.