Purple-team validation (lab)

Hypothesis:

Procedure (authorized, local):

Expected detection:

Result (TP / FN / FP):

ATT&CK mapping:

Control change:

Retest result:

Residual gap: