↻
Continuous Purple Loop
Coverage rises with every cycle
1Intel: TTP Ingested
A new threat-intel technique becomes a hypothesis. Source: Sentinel & Defender threat intelligence.
2Red: Emulate
Red agent safely emulates the TTP in a sandbox, mapped to MITRE ATT&CK / ATLAS. Human-approved scope.
3Blue: Detect?
Blue agent checks whether Sentinel / Defender detected it, flagging a coverage gap if nothing fired.
4Analyze: Root-Cause
Security Copilot root-causes the detection gap and proposes a new analytic rule.
5Engineer: Build & Test
Detection-engineering agent writes the rule, tests it against the emulation, and stages it for review.
6Human Gate: Approve
A human analyst reviews and approves before promotion. Human-in-command, not a rubber stamp.
7Promote: Deploy & Monitor
Approved rule ships to production in Sentinel. Coverage updates; Agent 365 logs every agent action.
↻ Phases
Intel
Red: emulate
Blue: detect
Analyze & engineer
Human gate
Promote