Ω / LINKS / METADATA ONLY

Cross-team tools.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Apache Caldera (Incubating)

Adversary-emulation orchestration and ATT&CK-aligned exercise reporting.

Adversary emulation Detection and control validation Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Atomic Red Team

Portable ATT&CK-aligned tests for telemetry and control validation.

Adversary emulation Detection and control validation Detection engineering

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Attack Flow

Attack-chain modeling, sequencing, visualization, and reporting.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

AttackIQ Platform

Commercial adversarial exposure and security-control validation platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

AWS CloudSaga

AWS security-event simulation for alert validation and incident-response exercises.

Cloud security Detection and control validation Incident response

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

BadZure

Disposable Azure and Entra lab orchestration for attack-path and detection exercises.

Detection and control validation Identity security Security lab orchestration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

BloodHound Community Edition

Graph-based identity and attack-path analysis for offensive and defensive workflows.

Identity security Vulnerability assessment

Apache-2.0 unless a lower-level component license states otherwise.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Cymulate Exposure Validation

Commercial adversarial exposure and detection-validation platform.

Detection and control validation Exposure validation and BAS

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

DefectDojo Community Edition

Application-security finding management, deduplication, and remediation workflow.

Application security Reporting and collaboration Vulnerability management

BSD-3-Clause for the open-source Community repository; commercial editions differ.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

DeTT&CT

ATT&CK data-source, detection-strategy, and maturity mapping.

ATT&CK mapping and coverage Detection engineering Threat intelligence

GPL-3.0
Reviewed Oct 12, 2026

CROSS-TEAM · RED TEAM

Dradis Community Edition

Collaborative assessment evidence and report management.

Reporting and collaboration

GPL-2.0 for Community Edition; Professional is commercial.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Falco Event Generator

Runtime event generation for Falco rule and throughput validation.

Detection and control validation Detection engineering

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · RED TEAM

Faraday

Multiuser finding normalization, remediation tracking, and reporting.

Reporting and collaboration Vulnerability management

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

Fleet

Endpoint visibility and device-management platform built around osquery.

Endpoint visibility and EDR Reporting and collaboration Vulnerability management

MIT core/free portions with separately licensed enterprise, documentation, and third-party components.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

Ghidra

Software reverse-engineering framework for malware and vulnerability research.

Malware analysis and reverse engineering Vulnerability assessment

Apache-2.0 core with GPL-3.0 support programs and separately licensed third-party components.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

IBM SimRun

Cloud attack simulation, log injection, and alert-matching validation.

Adversary emulation Cloud security Detection and control validation

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Infection Monkey

Adversary emulation and propagation-path validation for controlled environments.

Adversary emulation Detection and control validation Exposure validation and BAS

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Invoke-AtomicRedTeam

PowerShell orchestration for repeatable Atomic Red Team validation.

Adversary emulation Detection and control validation

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Editor

Creation and collaboration on custom security-capability mappings.

ATT&CK mapping and coverage Reporting and collaboration Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Explorer

Security-control-to-ATT&CK mapping and coverage exploration.

ATT&CK mapping and coverage Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

CROSS-TEAM · PURPLE TEAM · RED TEAM

Metasploit Framework

Modular framework for controlled validation and adversary emulation.

Adversary emulation Vulnerability assessment

3-Clause BSD for the framework; bundled dependencies have separate licenses.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

MISP

Threat-intelligence sharing and incident-context platform.

Incident response Malware analysis and reverse engineering Threat intelligence

AGPL-3.0 core; data libraries can have separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Navigator

ATT&CK matrix annotation and coverage visualization.

ATT&CK mapping and coverage Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Workbench

Local ATT&CK knowledge management, extensions, and sharing.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026