Authorised planning
Plan the evidence before a purple-team exercise begins.
Define a written boundary, benign ATT&CK validation methods, expected telemetry and accountable owners. This planner contains no exploit commands and executes nothing.
Scope first Named service, window and test boundary.
Benign methods Test identities, inert files and dummy data.
Evidence handoff Expected signals, owner and exit criteria.
Evidence plan not built yet
Complete the boundary to produce phases, exit criteria and an evidence handoff matrix.