Skip to content

Template changes for IOC notes, suggesting adding flowcharts for disclosure/cessation of the operation, and intentionally determining automatable TTPs

Thank you Duo for this summary of the changes:

This merge request updates GitLab's Red Team operation templates with several improvements:

Logistics template changes: Added guidance that Red Team exercises can continue even after being discovered, as long as they don't disrupt important company work or get completely shut down by defenders. Also added a requirement to create flowcharts for leadership to help them decide when to disclose operations and when to declare an operation concluded (two different things).

Adversary profiling template changes: Added a safety note requiring teams to "de-fang" (make harmless) any malicious domains and IP addresses in their documentation, preventing these indicators from being accidentally discovered through simple text searches across GitLab's platform.

Retrospective template changes: Added a new section focused on automation, asking teams to identify which attack techniques can be automated for future testing versus which ones are too complex or specific to automate. This helps the defensive teams improve their detection capabilities through repeatable automated tests.

Merge request reports

Loading