brooklynkid707-cmd/purple-team-pipeline

How brooklynkid707-cmd/purple-team-pipeline works

Purple Team Pipeline integrates an adversary plan, locally generated synthetic telemetry, three detection stacks, optional alert triage and ML scoring, and measured results in a report. The CLI starts the run; pipeline.py owns the principal orchestration. The README documents additional report outputs and sibling integrations. Some subsystem internals were not excerpted, so their documented capabilities are shown without asserting unsupported internal call paths.

Main entry points: pipeline.py Run orchestrator · engine.py Telemetry engine · runner.py Stack adapters · cli.py CLI

Components 26

Run entry

CLI ptp/cli.py
Run orchestrator ptp/pipeline.py
Sibling resolver ptp/siblings.py

Exercise and telemetry

Plan builder ptp/scenario.py
AEP planner
Telemetry engine ptp/telemetry/engine.py
Technique emitters ptp/telemetry/emitters.py
Event builders ptp/telemetry/builders.py
Synthetic inventory ptp/telemetry/inventory.py
Telemetry formats ptp/telemetry/formats.py
Stack telemetry files
Ground truth

Detection portfolio

Stack adapters ptp/detect/runner.py
Alert normalization ptp/detect/normalize.py
mini-SIEM
Splunk stack
Sentinel stack

Analysis and reporting

Copilot triage ptp/triage/copilot_triage.py
SOC copilot
ML scoring ptp/triage/mltd_scoring.py
ML detector
Coverage and MTTD ptp/score.py
Report and Navigator ptp/report.py
Incident narrative
Exercise artifacts

Other components

Operator

Connections 32

Operator → CLI: invokes README.md
CLI → Plan builder: exposes planning ptp/cli.py
CLI → Sibling resolver: checks siblings ptp/cli.py
CLI → Run orchestrator: starts run ptp/cli.py
Run orchestrator → Plan builder: builds plan ptp/pipeline.py
Plan builder → AEP planner: delegates planning ptp/scenario.py
Run orchestrator → Telemetry engine: runs telemetry ptp/pipeline.py
Telemetry engine → Technique emitters: selects emitters ptp/telemetry/engine.py
Telemetry engine → Event builders: creates builders ptp/telemetry/engine.py
Telemetry engine → Telemetry formats: converts formats ptp/telemetry/engine.py
Telemetry engine → Synthetic inventory: uses inventory ptp/telemetry/engine.py
Technique emitters → Event builders: builds events ptp/telemetry/emitters.py
Technique emitters → Synthetic inventory: uses inventory ptp/telemetry/emitters.py
Event builders → Synthetic inventory: registers hosts ptp/telemetry/builders.py
Telemetry engine → Stack telemetry files: writes stack files ptp/telemetry/engine.py
Telemetry engine → Ground truth: writes truth ptp/telemetry/engine.py
Run orchestrator → Stack adapters: runs detection ptp/pipeline.py
Stack adapters → mini-SIEM: runs stack ptp/detect/runner.py
Stack adapters → Splunk stack: runs stack ptp/detect/runner.py
Stack adapters → Sentinel stack: runs stack ptp/detect/runner.py
Stack adapters → Stack telemetry files: reads stack files ptp/detect/runner.py
Stack adapters → Alert normalization: normalizes alerts ptp/detect/runner.py
Run orchestrator → Copilot triage: triages alerts ptp/pipeline.py
Copilot triage → SOC copilot: processes alerts ptp/triage/copilot_triage.py
Run orchestrator → ML scoring: scores telemetry ptp/pipeline.py
ML scoring → ML detector: scores with models ptp/triage/mltd_scoring.py
Run orchestrator → Coverage and MTTD: measures outcome ptp/pipeline.py
Coverage and MTTD → Ground truth: joins truth ptp/score.py
Coverage and MTTD → Alert normalization: matches alerts ptp/score.py
Run orchestrator → Report and Navigator: writes report ptp/pipeline.py
Report and Navigator → Incident narrative: renders narrative README.md
Report and Navigator → Exercise artifacts: generates outputs README.md

Drawn by GitDiagram on November 9, 2026 from the repository's file tree, README and source files. Read as Markdown ·