# brooklynkid707-cmd/purple-team-pipeline architecture

> Architecture diagram of the GitHub repository brooklynkid707-cmd/purple-team-pipeline, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/brooklynkid707-cmd/purple-team-pipeline
- Repository: https://github.com/brooklynkid707-cmd/purple-team-pipeline

## Overview

Purple Team Pipeline integrates an adversary plan, locally generated synthetic telemetry, three detection stacks, optional alert triage and ML scoring, and measured results in a report. The CLI starts the run; pipeline.py owns the principal orchestration. The README documents additional report outputs and sibling integrations. Some subsystem internals were not excerpted, so their documented capabilities are shown without asserting unsupported internal call paths.

Main entry points: [`ptp/pipeline.py`](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/pipeline.py) (Run orchestrator), [`ptp/telemetry/engine.py`](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/engine.py) (Telemetry engine), [`ptp/detect/runner.py`](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/detect/runner.py) (Stack adapters), [`ptp/cli.py`](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/cli.py) (CLI)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Run entry"]
  node_cli["CLI<br/>[cli.py]"]
  node_pipeline["Run orchestrator<br/>[pipeline.py]"]
  node_siblings["Sibling resolver<br/>[siblings.py]"]
end

subgraph group_exercise["Exercise and telemetry"]
  node_scenario["Plan builder<br/>[scenario.py]"]
  node_planner["AEP planner"]
  node_engine["Telemetry engine<br/>[engine.py]"]
  node_emitters["Technique emitters<br/>[emitters.py]"]
  node_builders["Event builders<br/>[builders.py]"]
  node_inventory["Synthetic inventory<br/>[inventory.py]"]
  node_formats["Telemetry formats<br/>[formats.py]"]
  node_telemetry["Stack telemetry files"]
  node_groundtruth["Ground truth"]
end

subgraph group_detections["Detection portfolio"]
  node_runner["Stack adapters<br/>[runner.py]"]
  node_normalize["Alert normalization<br/>[normalize.py]"]
  node_minisiem["mini-SIEM"]
  node_splunk["Splunk stack"]
  node_sentinel["Sentinel stack"]
end

subgraph group_analysis["Analysis and reporting"]
  node_triage["Copilot triage<br/>[copilot_triage.py]"]
  node_copilot["SOC copilot"]
  node_mlscoring["ML scoring<br/>[mltd_scoring.py]"]
  node_mltd["ML detector"]
  node_score["Coverage and MTTD<br/>[score.py]"]
  node_report["Report and Navigator<br/>[report.py]"]
  node_soctk["Incident narrative"]
  node_artifacts["Exercise artifacts"]
end

node_user(("Operator"))

node_user -->|"invokes"| node_cli
node_cli -->|"exposes planning"| node_scenario
node_cli -->|"checks siblings"| node_siblings
node_cli -->|"starts run"| node_pipeline
node_pipeline -->|"builds plan"| node_scenario
node_scenario -->|"delegates planning"| node_planner
node_pipeline -->|"runs telemetry"| node_engine
node_engine -->|"selects emitters"| node_emitters
node_engine -->|"creates builders"| node_builders
node_engine -->|"converts formats"| node_formats
node_engine -->|"uses inventory"| node_inventory
node_emitters -->|"builds events"| node_builders
node_emitters -->|"uses inventory"| node_inventory
node_builders -->|"registers hosts"| node_inventory
node_engine -->|"writes stack files"| node_telemetry
node_engine -->|"writes truth"| node_groundtruth
node_pipeline -->|"runs detection"| node_runner
node_runner -->|"runs stack"| node_minisiem
node_runner -->|"runs stack"| node_splunk
node_runner -->|"runs stack"| node_sentinel
node_runner -->|"reads stack files"| node_telemetry
node_runner -->|"normalizes alerts"| node_normalize
node_pipeline -->|"triages alerts"| node_triage
node_triage -->|"processes alerts"| node_copilot
node_pipeline -->|"scores telemetry"| node_mlscoring
node_mlscoring -->|"scores with models"| node_mltd
node_pipeline -->|"measures outcome"| node_score
node_score -->|"joins truth"| node_groundtruth
node_score -->|"matches alerts"| node_normalize
node_pipeline -->|"writes report"| node_report
node_report -->|"renders narrative"| node_soctk
node_report -->|"generates outputs"| node_artifacts

click node_cli "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/cli.py"
click node_pipeline "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/pipeline.py"
click node_scenario "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/scenario.py"
click node_engine "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/engine.py"
click node_emitters "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/emitters.py"
click node_builders "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/builders.py"
click node_inventory "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/inventory.py"
click node_formats "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/formats.py"
click node_runner "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/detect/runner.py"
click node_normalize "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/detect/normalize.py"
click node_triage "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/triage/copilot_triage.py"
click node_mlscoring "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/triage/mltd_scoring.py"
click node_score "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/score.py"
click node_report "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/report.py"
click node_siblings "https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/siblings.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_pipeline,node_siblings toneBlue
class node_scenario,node_planner,node_engine,node_emitters,node_builders,node_inventory,node_formats,node_telemetry,node_groundtruth toneAmber
class node_runner,node_normalize,node_minisiem,node_splunk,node_sentinel toneMint
class node_triage,node_copilot,node_mlscoring,node_mltd,node_score,node_report,node_soctk,node_artifacts toneRose
class node_user toneIndigo
```

## Components

### Run entry

- [CLI](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/cli.py): `ptp/cli.py`
- [Run orchestrator](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/pipeline.py): `ptp/pipeline.py`
- [Sibling resolver](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/siblings.py): `ptp/siblings.py`

### Exercise and telemetry

- [Plan builder](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/scenario.py): `ptp/scenario.py`
- **AEP planner**
- [Telemetry engine](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/engine.py): `ptp/telemetry/engine.py`
- [Technique emitters](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/emitters.py): `ptp/telemetry/emitters.py`
- [Event builders](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/builders.py): `ptp/telemetry/builders.py`
- [Synthetic inventory](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/inventory.py): `ptp/telemetry/inventory.py`
- [Telemetry formats](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/telemetry/formats.py): `ptp/telemetry/formats.py`
- **Stack telemetry files**
- **Ground truth**

### Detection portfolio

- [Stack adapters](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/detect/runner.py): `ptp/detect/runner.py`
- [Alert normalization](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/detect/normalize.py): `ptp/detect/normalize.py`
- **mini-SIEM**
- **Splunk stack**
- **Sentinel stack**

### Analysis and reporting

- [Copilot triage](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/triage/copilot_triage.py): `ptp/triage/copilot_triage.py`
- **SOC copilot**
- [ML scoring](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/triage/mltd_scoring.py): `ptp/triage/mltd_scoring.py`
- **ML detector**
- [Coverage and MTTD](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/score.py): `ptp/score.py`
- [Report and Navigator](https://github.com/brooklynkid707-cmd/purple-team-pipeline/blob/main/ptp/report.py): `ptp/report.py`
- **Incident narrative**
- **Exercise artifacts**

### Other components

- **Operator**

## Connections

- Operator → CLI: invokes (evidence: `README.md`)
- CLI → Plan builder: exposes planning (evidence: `ptp/cli.py`)
- CLI → Sibling resolver: checks siblings (evidence: `ptp/cli.py`)
- CLI → Run orchestrator: starts run (evidence: `ptp/cli.py`)
- Run orchestrator → Plan builder: builds plan (evidence: `ptp/pipeline.py`)
- Plan builder → AEP planner: delegates planning (evidence: `ptp/scenario.py`)
- Run orchestrator → Telemetry engine: runs telemetry (evidence: `ptp/pipeline.py`)
- Telemetry engine → Technique emitters: selects emitters (evidence: `ptp/telemetry/engine.py`)
- Telemetry engine → Event builders: creates builders (evidence: `ptp/telemetry/engine.py`)
- Telemetry engine → Telemetry formats: converts formats (evidence: `ptp/telemetry/engine.py`)
- Telemetry engine → Synthetic inventory: uses inventory (evidence: `ptp/telemetry/engine.py`)
- Technique emitters → Event builders: builds events (evidence: `ptp/telemetry/emitters.py`)
- Technique emitters → Synthetic inventory: uses inventory (evidence: `ptp/telemetry/emitters.py`)
- Event builders → Synthetic inventory: registers hosts (evidence: `ptp/telemetry/builders.py`)
- Telemetry engine → Stack telemetry files: writes stack files (evidence: `ptp/telemetry/engine.py`)
- Telemetry engine → Ground truth: writes truth (evidence: `ptp/telemetry/engine.py`)
- Run orchestrator → Stack adapters: runs detection (evidence: `ptp/pipeline.py`)
- Stack adapters → mini-SIEM: runs stack (evidence: `ptp/detect/runner.py`)
- Stack adapters → Splunk stack: runs stack (evidence: `ptp/detect/runner.py`)
- Stack adapters → Sentinel stack: runs stack (evidence: `ptp/detect/runner.py`)
- Stack adapters → Stack telemetry files: reads stack files (evidence: `ptp/detect/runner.py`)
- Stack adapters → Alert normalization: normalizes alerts (evidence: `ptp/detect/runner.py`)
- Run orchestrator → Copilot triage: triages alerts (evidence: `ptp/pipeline.py`)
- Copilot triage → SOC copilot: processes alerts (evidence: `ptp/triage/copilot_triage.py`)
- Run orchestrator → ML scoring: scores telemetry (evidence: `ptp/pipeline.py`)
- ML scoring → ML detector: scores with models (evidence: `ptp/triage/mltd_scoring.py`)
- Run orchestrator → Coverage and MTTD: measures outcome (evidence: `ptp/pipeline.py`)
- Coverage and MTTD → Ground truth: joins truth (evidence: `ptp/score.py`)
- Coverage and MTTD → Alert normalization: matches alerts (evidence: `ptp/score.py`)
- Run orchestrator → Report and Navigator: writes report (evidence: `ptp/pipeline.py`)
- Report and Navigator → Incident narrative: renders narrative (evidence: `README.md`)
- Report and Navigator → Exercise artifacts: generates outputs (evidence: `README.md`)