Skip to main content
The Cyber Security: ethical hacking and cyber security training, Canada
Register
Advanced

Purple Team Tactics and Kill Chain Defences

Attacks and defences make the most sense side by side. This purple team course maps each stage of the intrusion kill chain to concrete prevention and detection controls, then proves whether those controls work through heavy adversary emulation.

You play both roles: running attacker techniques in a monitored lab, watching what the security information and event management, or SIEM, platform records, and closing the gaps where an action produced no useful signal.

Duration
10 weeks
Format
Live online, instructor-led
Prerequisites
Hacker Tools, Techniques and Incident Handling
Class size
Capped at 12 learners
Purple Team Tactics and Kill Chain Defences

What you will be able to do

  • Map the intrusion kill chain to prevention and detection controls
  • Emulate attacker techniques safely in a monitored lab
  • Judge whether a control actually detected or blocked an action
  • Build and tune SIEM and EDR detections that fire on real activity
  • Measure detection coverage against MITRE ATT&CK honestly
  • Run a structured purple team exercise with agreed results
  • Report coverage and gaps in terms leaders can prioritise

Course outline

6 modules

  • Walking the intrusion kill chain
  • Mapping stages to MITRE ATT&CK
  • Prevention versus detection at each stage
  • Setting measurable defensive goals

What you need before you start

  • Completion of Hacker Tools, Techniques and Incident Handling or equivalent
  • Familiarity with logs, SIEM concepts and basic detection
  • Comfort with both attacker tooling and defensive consoles
  • Understanding of the MITRE ATT&CK framework

Who this course is for

  • Blue teamers who want to test their detections against real attacks
  • Penetration testers moving toward collaborative purple work
  • Detection engineers validating their coverage
  • Analysts preparing for the CompTIA CySA+ exam

Where this leads

Prepares you for

CySA+

Awarded by CompTIA

CompTIA awards the CySA+ certification when you pass its exam, not the academy. This course strengthens the behavioural analytics, detection and response skills CySA+ assesses by pairing every attacker technique with the defensive signal it should produce.

Questions about this course

More in offensive security

Ready to launch your cyber security career?

Join the next live online cohort. No experience required, just bring the curiosity.

Register nowCall 1 (647) 547-0942