Ω / LINKS / METADATA ONLY

Purple team tools.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Apache Caldera (Incubating)

Adversary-emulation orchestration and ATT&CK-aligned exercise reporting.

Adversary emulation Detection and control validation Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Atomic Red Team

Portable ATT&CK-aligned tests for telemetry and control validation.

Adversary emulation Detection and control validation Detection engineering

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Attack Flow

Attack-chain modeling, sequencing, visualization, and reporting.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

AttackIQ Platform

Commercial adversarial exposure and security-control validation platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

AWS CloudSaga

AWS security-event simulation for alert validation and incident-response exercises.

Cloud security Detection and control validation Incident response

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

BadZure

Disposable Azure and Entra lab orchestration for attack-path and detection exercises.

Detection and control validation Identity security Security lab orchestration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

BloodHound Community Edition

Graph-based identity and attack-path analysis for offensive and defensive workflows.

Identity security Vulnerability assessment

Apache-2.0 unless a lower-level component license states otherwise.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Cymulate Exposure Validation

Commercial adversarial exposure and detection-validation platform.

Detection and control validation Exposure validation and BAS

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

DefectDojo Community Edition

Application-security finding management, deduplication, and remediation workflow.

Application security Reporting and collaboration Vulnerability management

BSD-3-Clause for the open-source Community repository; commercial editions differ.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

DeTT&CT

ATT&CK data-source, detection-strategy, and maturity mapping.

ATT&CK mapping and coverage Detection engineering Threat intelligence

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Falco Event Generator

Runtime event generation for Falco rule and throughput validation.

Detection and control validation Detection engineering

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

IBM SimRun

Cloud attack simulation, log injection, and alert-matching validation.

Adversary emulation Cloud security Detection and control validation

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Infection Monkey

Adversary emulation and propagation-path validation for controlled environments.

Adversary emulation Detection and control validation Exposure validation and BAS

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Invoke-AtomicRedTeam

PowerShell orchestration for repeatable Atomic Red Team validation.

Adversary emulation Detection and control validation

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Editor

Creation and collaboration on custom security-capability mappings.

ATT&CK mapping and coverage Reporting and collaboration Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Explorer

Security-control-to-ATT&CK mapping and coverage exploration.

ATT&CK mapping and coverage Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

CROSS-TEAM · PURPLE TEAM · RED TEAM

Metasploit Framework

Modular framework for controlled validation and adversary emulation.

Adversary emulation Vulnerability assessment

3-Clause BSD for the framework; bundled dependencies have separate licenses.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Navigator

ATT&CK matrix annotation and coverage visualization.

ATT&CK mapping and coverage Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Workbench

Local ATT&CK knowledge management, extensions, and sharing.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

msInvader

Microsoft 365 and Azure simulation for telemetry and detection validation.

Adversary emulation Detection and control validation Identity security

Apache-2.0
Reviewed Oct 12, 2026

PURPLE TEAM · RED TEAM

Nuclei

Template-based exposure validation after explicit scope and authorization.

Application security Detection and control validation Vulnerability assessment

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

OpenAEV

Adversarial exposure validation, atomic testing, and exercise reporting platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Community Edition Apache-2.0; Enterprise Edition uses Filigran terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Picus Autonomous Exposure Validation Platform

Commercial adversarial exposure and attack-path validation platform.

Detection and control validation Exposure validation and BAS

Proprietary annual subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Prowler

Cloud posture, identity, compliance, and exposure assessment.

Cloud security Vulnerability management

Apache-2.0 for the canonical open-source project; managed editions have separate terms.
Reviewed Oct 12, 2026