Kiber təhlükəsizlik · 10 min read

What is the difference between Red Team, Blue Team and Purple Team?

The difference between Red Team and Blue Team in one sentence: one team attacks with permission, the other detects that attack and builds the defense. The offensive team (Red Team) acts like a real attacker on the basis of written authorization and exploits vulnerabilities. The defensive team (Blue Team) monitors logs, writes detection rules and responds to incidents. Purple Team is not a separate team — it is a format of joint work between offense and defense: the offensive team executes a technique, and the defensive team learns to detect it.

What is Red Team and what does its daily work consist of?

The offensive team (Red Team) is a group that tests an organization's defenses with the logic of a real attacker. The work is carried out only on the basis of written consent and a contract, within a previously agreed scope. The goal is not to destroy the system but to demonstrate with evidence how far an attack can progress.

Daily work often differs from the picture in the movies. Most of the time goes to reconnaissance, confirming vulnerabilities and documentation.

• Reconnaissance (recon): domain, subdomains, open ports, employee email structure, technology stack.
• Testing web and API vulnerabilities: access control, injection-type vulnerabilities, authentication logic.
• Exploiting server-side and system vulnerabilities, building a chain leading to remote code execution.
• Active Directory attacks: Kerberoasting, AS-REP roasting, credential theft, Pass-the-Hash.
• Lateral movement inside the network and the post-exploitation phase: stealthy movement through the network, privilege escalation, managing C2 (command and control) infrastructure.
• Reporting: the impact of the finding, risk level, reproduction steps and remediation recommendation.

The final product of the work is not an exploitation guide but a penetration testing report. The report gives the technical team a remediation plan and gives management a picture of the risk. Without a good report, a discovered vulnerability creates no value for the organization.

What is Blue Team and how is defense built?

The defensive team (Blue Team) works to see an attack in time and stop it. This work is mainly concentrated in the security operations center (SOC). The foundation of defense lies not in a tool but in a high-quality collection of logs.

• Collecting and normalizing logs: Windows event logs, Linux system logs, network and application logs.
• Setting up a SIEM (security information and event management): connecting sources, retention period, search and correlation logic.
• Writing detection rules and mapping them to MITRE ATT&CK techniques.
• Reducing false positives — when there is a lot of noise, a real event gets lost.
• Incident response: preparation, detection, containment, eradication, recovery and lessons learned.
• Threat hunting: searching for traces in the logs based on a hypothesis, without waiting for a ready-made signal.

NIST SP 800-61 describes incident response as a phased process. In practice this means the success of the defensive team is not measured by the number of signals alone. The key indicator is how quickly an incident is noticed and how quickly it is closed.

What is Purple Team — a third team or a working format?

Purple Team is sometimes presented as a third staffing unit, although it is in fact an operating format. The offensive and defensive teams sit at the same table, observe the same technique from two sides and measure the result. This way the question is posed not as «who won» but as «which technique was detected».

1. A target technique is selected — for example, Kerberoasting or Pass-the-Hash, cataloged in MITRE ATT&CK.
2. The offensive team executes the technique in a closed lab and records the execution time precisely.
3. The defensive team checks which log entries were generated in that time window.
4. If there is no signal, a detection rule is written or an existing rule is refined.
5. The technique is executed again: does the rule work, does it produce false positives?
6. The result is documented — which techniques are detected, which are not, and what the gap-closing plan is.

What are the main differences between Red Team, Blue Team and Purple Team?

The main point visible from the table is this: the three roles are not rivals but three stages of the same process. The offensive team finds the gap, the defensive team makes it visible, and the Purple Team format links these two results together.

What tools do they work with?

A list of tools does not define a role, but it shows the nature of daily work well. The breakdown below follows the module logic of offensive team training.

• Web application phase: Burp Suite, Nmap, ffuf, sqlmap — finding and confirming vulnerabilities.
• Server and system phase: ysoserial, commix — exploiting server-side vulnerabilities.
• API and mobile phase: MobSF, Frida, jadx, Postman — application analysis and authentication testing.
• Active Directory phase: BloodHound, Mimikatz, CrackMapExec, Rubeus — domain attacks.
• Lateral movement inside the network and post-exploitation phase: Havoc, Sliver, Evil-WinRM, Empire — C2 infrastructure and stealthy movement.
• Operations and reporting: Caldera, Atomic Red Team, CherryTree — scenario execution and documentation.

Which role suits you: how can you check yourself?

It is better to make the choice based on working style rather than salary expectations. Answer the following questions honestly.

• Are you more drawn to looking for a way to break a system, or to restoring and hardening it?
• Can you stay calm under shift work and a constant flow of signals? This is normal on the defensive side.
• Do you have the patience to write long, structured reports? Half of the offensive team's work is documents.
• Are you familiar with networking basics, the Linux command line and Windows/Active Directory logic?
• Does repetitive analysis wear you out, or do you find it interesting to track down a trace in the details?
• Do you like communicating with a team on an ongoing basis? The Purple Team format is built precisely on this.

If most of your answers lean toward «find and prove», the offensive team direction suits you. If the answers «see, restore, systematize» prevail, the defensive team is a more natural start. As experience grows, moving between the two sides is common.

Which sequence makes more sense when starting from scratch?

1. Build the foundation: network protocols, Linux administration, Windows and Active Directory basics.
2. Choose a direction: on the defensive side, logs, SIEM and detection logic; on the offensive side, web, system and Active Directory attacks.
3. Practice in a closed lab — theory alone teaches you neither to write a report nor a detection rule.
4. Develop the habit of writing reports: the finding, impact, evidence, recommendation structure works on both sides.
5. Join Purple Team exercises: check what trace the technique you executed leaves in the log.
6. Draw up your own skills map based on MITRE ATT&CK and put the gaps into a plan.

Groups have 8–12 people, and a new group starts every month. The small-group format allows individual tracking on lab assignments. Each program concludes with a Log Academy certificate and preparation for international certifications.

Is Red Team work legal in Azerbaijan?

Yes, but on one condition only: there must be written authorization and a contract. Penetration testing is carried out on the basis of a document with a scope, time window and rules agreed with the client. Without this document, the same actions count as unauthorized access to a computer system.

• The Criminal Code of the Republic of Azerbaijan defines unauthorized access to computer systems and unlawful interference with data as a crime.
• The explanation «I did it for testing purposes» is not considered legal protection without written consent.
• Going beyond the scope — a domain, system or third-party service that was not authorized — creates a separate risk.
• Information about a discovered vulnerability is given only to the client and is not shared publicly.
• In training, all tasks are carried out in a closed lab environment, on an isolated network.

Our editorial principle comes from here as well: the content provides no working exploitation instructions. The explanation is built around concepts, defense and careers. The goal is not to answer «how is hacking done» but the question of how to become a professional in this field.

How do the offensive and defensive sides meet in our lab?

1. A working document for the module exercise is prepared: the target domain, permitted actions, time window and stop conditions.
2. Participants are divided into two subgroups; each subgroup fills in its own log and note template in advance.
3. After the exercise, the notes of both sides are compared face to face: which step was visible, and which left no trace at all.
4. The difference between a persistent trace (disk, registry) and a transient one (memory, session) is noted separately.
5. The detection rule that was written is re-tested in the next lesson, and the number of false positives is measured.
6. The final document is added to the portfolio: finding, impact, evidence, recommendation — in a format you can show at a job interview.