category: fleet-family · status: shipped (v0.1, telemetry-sim mode) · updated: 2026-11-02

Purple Loop — red-trains-blue environment family

Runnable code: [[purple-loop|fleet/purple-loop/]] (README.md there is the operator doc; this page is the vault view). Part of stream D.

What it is

The loop nobody has shipped: a red agent generates randomized ATT&CK attacks (Atomic-Red-Team-shaped catalog: T1003, T1059.001/.003, T1105, T1560.001, T1053.005, T1547.001, T1087.001), the attacks are rendered into Sysmon-style telemetry (8 event IDs with canonical EventData fields, real decodable command lines — the -enc payloads are genuine UTF-16LE base64) mixed with benign noise at a randomized injection point, and a blue agent hunts them under a 50-query SQL budget; a detector track takes Sigma YAML and scores precision/recall against the labeled stream. Both sides' trajectories are kept as verified training data. Grading is Simbian-style: coverage over narrative steps, precision, per-technique/tactic recall, and an attribution-gap diagnostic.

Why it matters

[[landscape-2026]] white space: Simbian benchmarked blue hunting (best model 0.55 coverage, 0/32 pass) but ships no training; CyberGym-E2E is purple eval only; Novee trains offense only, closed. Closing red→telemetry→blue into a loop with kept trajectories is the unclaimed flank, and it is the blue-side RLVR environment our doctrine calls for.

Components

module	role
attack_gen.py	red: atomic selection + per-run variant randomization (names, paths, hashes, GUIDs, ports, timing)
telemetry_sim.py	Sysmon-style events.jsonl + private ground_truth.json; BOTSv3-CC0 bootstrap for real noise
hunt_env.py	DuckDB(SQLite-fallback) hunt env; 50 queries, 10-row results, free verdict submission; module-level grader
sigma_gen.py	Sigma YAML → DuckDB/SQLite SQL + EQL equivalent → P/R/F1 vs labels
rules/, smoke.sh	six sample detectors; end-to-end smoke (green, 3 seeds)

Lineage — copy

• Simbian CDB (arXiv 2604.19533): 50-query budget / 10-row capped results

with full counts / free submissions; coverage scored over narrative steps; per-tactic recall; attribution-gap finding (agents see evidence they fail to report); seeded time-shift + entity substitution + GUID re-randomization as anti-memorization; determinism from a seed. Verified against paper v1.0 and the MIT sample repo 2026-11-02.

• CTFusion: contamination paranoia — nothing string-memorizable survives a

reseed; fresh instances over fixtures.

• Open formats: ART YAML schema, Sigma schema, Sysmon EventData names,

BOTSv3 (CC0) as noise source. No SigmaHQ rule content vendored (DRL 1.1).

Lineage — avoid

• Simbian's closed corpus (gated "credible organizations") — ours is open and

reproducible from a seed.

• Timestamp-only grading — we grade technique + entity + time window (hunting,

not copy-paste).

• Simbian shipping zero training on their own benchmark — the kept

trajectories are the point here.

• Static fixtures anywhere in the loop.

Status & next

• [x] v0.1 shipped 2026-11-02: embedded catalog, telemetry sim, hunt env +

grader, sigma track, smoke green (coverage 0.67–1.0 across seeds — variants that survive heuristics are the training signal).

• [ ] Real-lab mode: Invoke-AtomicRedTeam → WEF/Winlogbeat → this schema

(grader contract unchanged).

• [ ] --art-dir per-technique telemetry templates for imported atomics.
• [ ] LLM-driven red improvement loop wired to the training harness (stream F).

See also: [[held-out-eval]] · [[landscape-2026]] · [[cyberfactory-openaegis]]