# Tenable Purple Team Dashboard

> Joins Tenable pentest/attack-path findings against Blue Team remediation to compute residual risk and an ATT&CK coverage heatmap.

- Type: Skill
- Author: rafansmpj
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-09-14
- Source repository: https://github.com/rafansmpj/tenable-purple-team-dashboard
- Repo state: not archived
- Last push: 2026-09-11T16:03:33Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: threat-intelligence, vulnerability-management
- Tags: purple-team, red-team, blue-team, mitre-attack, residual-risk, vulnerability-management, dashboard
- Date added: 2026-09-11
- Compatible platforms: Claude Code, Claude Desktop, Claude Cowork
- Invocation: `/tenable-purple-team-dashboard`
- Listing page: https://exchange.tenable.com/skills/tenable-purple-team-dashboard
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-purple-team-dashboard.md

The Tenable Purple Team Dashboard skill joins Red Team attack findings (pentest / attack-path results tagged with MITRE ATT&CK techniques) against Blue Team remediation and compliance evidence, answering the question two separate silos can't: given what Blue actually fixed, what can Red still do?

## What it does

Pulls findings, asset exposure, finding state, and compliance/IoE data live from the Tenable MCP (Tenable One / VM / Identity Exposure / ASM), optionally overlaid with uploaded pentest evidence, ticket exports, or GRC mappings. Produces a single standalone HTML dashboard with a scorecard (Red findings next to Blue mitigations), an ATT&CK technique heatmap, a validation scoreboard for re-tested mitigations, a residual-risk rollup, a data-quality tab, and a run-over-run changes tab.

## How it works

`scripts/purple_join.py` normalizes and joins the three Tenable entities plus any overlays on finding ID or shared ATT&CK technique ID, then scores residual risk as unmitigated finding × severity × exploitability × exposure × asset criticality — a closed-but-unvalidated ticket keeps 40% of its risk by default, only a Red-confirmed retest drops it to zero. `scripts/render_dashboard.py` renders the scored state into a standalone HTML file (inline CSS/JS, no CDN) with the state embedded so the previous run alone is enough to compute the next delta. It's read-only: nothing is written back to Tenable, ticketing, or GRC systems.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-purple-team-dashboard.json. The full index and how to read it: https://exchange.tenable.com/llms.txt