slack-watchman VS EnterprisePurpleTeaming

You might want to look at platforms like Scythe and into purple teaming in general. Aside from that quite the number of projects involving attack simualtion on atomic level using caldera or atomic red team. Another great resource: https://github.com/ch33r10/EnterprisePurpleTeaming

As you are about to purpleteam yourself, Xena Olsen got you covered with a lot of great resources and a stuctured methodic approach: https://github.com/ch33r10/EnterprisePurpleTeaming Above that, when using Splunk you most probably had a look at the boss of the soc datasets - prequalified/-recorded close2real attack data which will assist in getting the hang of being able to discern the good from the bad; on a side note - with Splunk now pubicly sharing their security content (=use cases) you have another source to check out the level of correlation and most importantly the context information needed to make a decision. Context is everything - only by having all the facts you'll be able to tell whether that shadow copy deletion came from the backup agent or your friendly neighborhood ransom gang.

Dr. Xena has got you covered - check tool section: https://github.com/ch33r10/EnterprisePurpleTeaming

Here's an Enterprise Purple Team resource (I will continue adding items): https://github.com/ch33r10/EnterprisePurpleTeaming