Agentic Purple-Teaming via Google SecOps

Google Security Engineering has introduced an agentic purple-teaming framework for Google SecOps designed to automate detection validation. By inverting the standard "Attack-to-Detection" workflow, the system utilizes the Google Agent Development Kit (ADK) to perform "rule inversion." The agent parses Sigma rules to identify required observables and subsequently generates deterministic synthetic telemetry, such as Sysmon XML, to test the ingestion and detection pipeline. This methodology allows for granular failure analysis across five distinct states, including ingestion lag and searchability failures, significantly reducing the operational overhead associated with traditional host-based attack simulations and EDR management.

• Research/Tooling Overview: Automating Detection Validation

  • Transitions from manual, labor-intensive "Attack -> Telemetry -> Detection" flows to an automated "Detection -> Synthetic Telemetry -> Validation" loop.
  • Minimizes operational complexity by eliminating the need for host preparation, manual attack tool deployment, and EDR exclusion management.
  • Provides critical validation for Detection Engineers and SOC Analysts to ensure high-fidelity alerts and pipeline integrity.

• Methodology/Technical Stack: The Agentic Inversion Loop

  • Utilizes the Google Agent Development Kit (ADK) for orchestration and the Model Context Protocol (MCP) for secure, authenticated connection to Google SecOps.
  • Employs a Chroma Vector Database and Reciprocal Rank Fusion (RRF) to perform intent-based retrieval of Sigma rules.
  • Uses a Deterministic Mapping Layer to convert inverted Sigma conditions into valid Windows event structures, such as Sysmon XML.

• Key Findings/Technical Highlights: Performance and Granularity

  • Achieved an 89.9% successful match rate, validating 2,182 rules out of a corpus of 2,855 Windows Sigma rules.
  • Enabled precise failure attribution across five distinct states: local verification failure, platform processing lag, searchability failure, detection mismatch, and downstream alert/case failure.
  • Injects unique "PT-LAB-" synthetic markers into telemetry to ensure perfect attribution and searchability during testing.

• Industry/Defense Implications: A Shift in Purple-Teaming

  • Moves the security testing paradigm from manual adversary emulation to programmatic telemetry and detection logic validation.
  • Allows organizations to identify specific architectural bottlenecks, such as ingestion delays or detection logic gaps, without live environmental risk.
  • Enables large-scale, automated testing of thousands of detection rules to maintain defensive posture at scale.

• Conclusion: Enhancing Defensive Resilience

  • Decoupling LLM orchestration from deterministic telemetry generation ensures ground-truth accuracy in security validation workflows.
  • Agentic frameworks provide a scalable, low-overhead solution for modernizing the continuous validation of SIEM and detection pipelines.