Tenable Purple Team Dashboard
Joins Tenable pentest/attack-path findings against Blue Team remediation to compute residual risk and an ATT&CK coverage heatmap.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
The Tenable Purple Team Dashboard skill joins Red Team attack findings (pentest / attack-path results tagged with MITRE ATT&CK techniques) against Blue Team remediation and compliance evidence, answering the question two separate silos can’t: given what Blue actually fixed, what can Red still do?
What it does
Pulls findings, asset exposure, finding state, and compliance/IoE data live from the Tenable MCP (Tenable One / VM / Identity Exposure / ASM), optionally overlaid with uploaded pentest evidence, ticket exports, or GRC mappings. Produces a single standalone HTML dashboard with a scorecard (Red findings next to Blue mitigations), an ATT&CK technique heatmap, a validation scoreboard for re-tested mitigations, a residual-risk rollup, a data-quality tab, and a run-over-run changes tab.
How it works
scripts/purple_join.py normalizes and joins the three Tenable entities plus any overlays on finding ID or shared ATT&CK technique ID, then scores residual risk as unmitigated finding × severity × exploitability × exposure × asset criticality — a closed-but-unvalidated ticket keeps 40% of its risk by default, only a Red-confirmed retest drops it to zero. scripts/render_dashboard.py renders the scored state into a standalone HTML file (inline CSS/JS, no CDN) with the state embedded so the previous run alone is enough to compute the next delta. It’s read-only: nothing is written back to Tenable, ticketing, or GRC systems.