Designing the Exercise

## What deconfliction is for An adversary-emulation exercise deliberately puts activity into a production estate that looks, to every sensor and every analyst on shift, exactly like an intrusion. That is the point: if it did not look like one, it would prove nothing. The consequence is that at some hour of some night a defender will be holding evidence they cannot distinguish from a real compromise. **Deconfliction** is the mechanism agreed in advance for answering, quickly and authoritatively, one question about any observed activity: *was that us?* ## The people - **A red-side contact.** An operator or engagement lead who holds the operator log — every host touched, every command run, every source address, with timestamps — and who is reachable for the whole engagement window, not only in business hours. - **A client-side contact.** Usually the exercise sponsor or a designated trusted agent: someone who knows the exercise exists, holds the signed authorisation, and can confirm to a defender that an exercise is genuinely running. This person exists because the red team vouching for its own legitimacy is the weakest possible check. - **Named alternates for both.** One contact with one phone is a single point of failure in the middle of the night, and the failure is expensive: the SOC keeps escalating, wakes an executive, and dials the incident-response retainer whose clock starts on the call. ## Out of band, and recorded in advance Contact details are exchanged before the exercise begins and must not depend on anything in scope. A response can include isolating laptops, disabling accounts, or blocking a mail tenant — so the chat channel or mailbox you planned to use may be precisely what has just been cut off, or may be considered compromised and therefore untrusted. Phone numbers, and a copy in the SOC's own runbook that survives the estate going dark, are the normal arrangement. ## What the answer is, and what it is not The answer is an **attribution**: "yes, at 02:07 our operator ran that on DC02 from 10.4.1.19", or "no, that is not ours." Three things it is not: 1. **Not authorisation.** Permission to run the exercise comes from the signed scope letter and the person with authority over the systems. A deconfliction contact confirms who did something; they do not make it lawful. 2. **Not a stop order and not a close order.** What the defenders do next — release a host, keep hunting, close the case — is the client's decision, taken with their own leadership. 3. **Not a blanket.** "We are testing this week" attributes nothing. A useful answer is per-activity: the host, the timestamp, the process, the account, the source address. ## It runs in both directions Defenders call the red team when an alert might be test traffic. Operators call the client when they believe they have caused harm beyond what was expected, when access has reached something outside scope, when they see evidence of a **real** intruder in the estate, or when they think they have just triggered an expensive response. "We think we have just cost you a retainer callout" is a legitimate deconfliction call, and a mature red team makes it unprompted. ## Why the defender should ask for detail and give none A claim of authorisation is itself a social-engineering technique — "don't worry, that's the red team" is a cheap thing for an intruder to say. So the strong form of deconfliction is the operator stating facts the defender has *not* disclosed: the exact command line, the file written, the account used. The defender's side of the call is questions, not disclosures. And the verification chain has to root in something trusted before the exercise: a number recorded in the runbook, a person whose voice is known, the sponsor — never a callback number offered by the caller. ## Write the call down The call belongs in the case record: who called whom, on which recorded number, at what time, which specific activity was attributed to the exercise and which was not. That record is what turns a 02:00 stand-down into a defensible closure, and it is what the engagement report gets reconciled against afterwards. It also preserves the honest outcome for the exercise itself: the detection fired, the analyst worked it correctly, and only the actor turned out to be authorised.