joasasantos/neuropurple

NeuroPurple is an autonomous SOC and purple-team engine, exposed through a conversational CLI. Its investigation workflow normalizes local or connected telemetry, extracts and enriches indicators, analyzes and hunts for evidence, verifies findings, and reports results. A parallel purple-team loop emulates ATT&CK techniques, checks detection coverage, and develops detection rules; SOAR adds analyst-approved response actions. The graph follows documented workflows and sampled calls; several README capabilities have no sampled implementation path or wiring, so their links are not asserted.