This is an offline single-HTML app. No data goes to or from the internet — no server, no account, no telemetry. Your engagements live in your browser's sessionStorage, and any evidence files you attach live in its IndexedDB — on this device, in this browser, and nowhere else.
Purple-team records name real hosts and controls. This data is sensitive, and it is YOUR responsibility.
Clearing this site's data, opening it in a private window, switching browsers, or losing this device erases everything. Back up regularly — the topbar Export button saves a .pumapack you can re-import or drag back onto the window.
PumaPurple — Help & shortcuts
What's new
PumaPurple tracks a purple-team engagement: a list of adversary actions, each scored on two independent questions — did a control stop it, and did the SOC see it. No server, no account, no telemetry.
Two axes, four outcomes — every test rolls up to Prevented, Alerted, Logged or Missed. Keeping Logged apart from Alerted is the point of the whole tool: the first is a tuning job, the second is a visibility gap, and collapsing them is how a purple-team report quietly overstates a SOC.
The grid will not let you score — results are read-only in the table. Scoring happens inside the test, beside the ratings, severity and evidence that justify it, so a stray click cannot rewrite a finding you already recorded.
Re-tests remember what they re-run — duplicate a test and the copy carries its lineage, showing the old result beside the new one. The engagement is judged on gaps closed, not gaps found, and that count is the one the Stats view keeps.
Evidence is hashed — paste or drop screenshots and exports onto a test; each is SHA-256'd, so a report can prove the artefact it cites is the artefact you collected.
Gaps leave as tickets — right-click any gap to copy it as a detection ticket: technique, what was run, the result, and the specific ask, ready to paste into a tracker.
ATT&CK coverage, with the caveat attached — the techniques you tested, grouped by tactic and coloured by worst result, counted against the full Enterprise catalogue. A fully green matrix means you tested what you thought to test; it says nothing about what you did not.
Reports that carry their pictures — export Word with your evidence screenshots embedded as captioned figures, or Markdown, CSV, JSON, .xlsx, an ATT&CK Navigator layer, or a results-stripped .pumaplan you can reuse next quarter without leaking findings.
See the Method tab for how an engagement actually runs, and Keyboard for every shortcut.
Running a purple-team engagement
Purple teaming isn't red team versus blue team. Both sides sit in the same room, run a known action, and watch together to see what the defences actually did. The output isn't a win or a loss — it's a list of specific, fixable gaps.
1 · Scope it — pick a threat worth emulating and list the actions. One test = one ATT&CK technique, named concretely enough to re-run: Registry Run Key — Admin (LOLBin) beats persistence test. Define your assets first — the hosts you run from and against, the tooling, the controls you are measuring — so every test scores against the same vocabulary.
2 · Say what you're proving — set Focus to Prevent or Detect before you run. A test with no stated intent cannot fail, and will not appear in your gap list.
3 · Run it and stamp it — Start, execute, Stop. That window is what makes the action findable in the logs an hour later, when you are reconstructing what the SIEM saw. Both work on a selection, so you can start twenty at once.
4 · Score both axes honestly — prevention first: blocked, partial, or not at all. Then detection, strictly: Alerted means someone was told; Logged means the data existed and nobody was. Rate the quality too — an alert that fires four hours late with no context is not a 5 — and stamp the alert time on the slow ones, which is what turns "late" into a number.
5 · Tune, then re-test — this is the part that makes it purple. Write the detection, duplicate the test, and prove the fix. One gap closed and re-verified is worth more than ten merely found.
6 · Report the gaps — the Stats view ranks everything focused on prevention or detection that achieved neither, worst urgency first. That list is the deliverable; the rest is the evidence for it.
Where your engagements live
Everything is stored in your browser — engagements in sessionStorage, evidence files in IndexedDB — on this device and this browser only. Nothing is uploaded anywhere.
This is the whole database. If you clear site data, use a private window, switch browsers, or lose the device, your engagements are gone. Back up regularly.
Backing up
The Export button writes a .pumapack containing every engagement; ⌘/Ctrl+S saves a quick backup. Restore with Import, or by dragging the file onto the window.
Evidence files are not inside the backup. They live in IndexedDB and can be large. The pack keeps each file's name, size and SHA-256 so the report stays verifiable, but export the originals separately if you need them.
Clear all local data
Danger zone. This erases every PumaPurple engagement and every evidence file in this browser. Export a backup first.
Type DELETE EVERYTHING to confirm:
⌘/Ctrl + K
Command palette — jump to any view, test, or action
?
Open this help
⌘/Ctrl + S
Save a quick backup
N
New test
/
Focus the search box
Esc
Close drawer / dialog / menu
About PumaPurple
PumaPurple is a lightweight, portable, offline purple-team exercise tracker that runs entirely in your browser.
This tool is provided as-is, for informational and productivity purposes only. It is not professional security advice. All testing decisions, findings, and records are your own.
Per-technique Reference links point out to MITRE ATT&CK, Atomic Red Team (Red Canary), and Sigma (SigmaHQ). Those projects' content is linked for reference, not bundled or redistributed.
Acknowledgements
PumaPurple owes a debt to PurpleOps (CyberCX, Apache 2.0), an earlier open-source purple-team tracker that mapped much of this ground first. PumaPurple is an independent, from-scratch take with different goals: a single offline HTML file with no server, database, or accounts.
About PumaWorx
PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.