This is application purple teaming
summary
Application purple teaming applies red/blue exercises to development so developers run detection in production, backed by playbooks mapping bug classes to concrete log artifacts (JDBC syntax errors for SQLi, Runtime IOExceptions for command injection, spikes and file not founds for SSRF). It uses ELK/Splunk and Sentry and linters like SonarLint plus AppSensor patterns, tracks a trace id through services, enforces a zero exception policy, and automates actions (raise per-user log level, block, captcha); Greg’s 124-report dataset shows 17% of SSRFs are import-by-URL.
AI-written summary · about
chapters (27)
- 0:00Intro
- 1:13About me
- 2:51Purple teaming
- 4:40Maturity model
- 6:30Goals
- 8:17Anomalies and interruptions
- 9:07Risk modelling
- 10:47Anticipating exceptions
- 12:14Having the right information
- 13:27Being agile
- 16:00Log types
- 17:12Making exceptions "observable"
- 19:51Diagnostics of exceptions
- 20:29Debug logging principles
- 21:55Auditing expected events
- 23:07Example audit logging
- 24:29Common attacks
- 24:45Injection attacks
- 25:20SQL injection
- 26:00SQLi Detection point
- 27:14Example: Server SQLSyntaxError
- 29:59Detecting command injection
- 34:31Detecting SSRF (More)
- 35:38Common SSRF methods
- 39:28Detecting CSRF
- 42:58Takeaways
- 44:36Thank you, don't be a stranger!
related talks
25mStandard Classification: Purple Teaming with PurpleTeam
29mPurple Teaming with OWASP PurpleTeam
30mPurple Teaming with OWASP PurpleTeam
39mColorful AppSec - Red, Blue, or Purple?
52mBuilding the Always-On Purple Team
41mPurple Is the New Red - Providing the Most Value from Offensive Security
34mPurple Team Strategies for Application Security
43mShades of Purple: Getting Started and Making Purple Teaming Possible