A detection engineering lead and red team lead are co-designing a purple team exercise to validate whether the SOC's SIEM detections fire correctly against specific ATT&CK techniques. They need a structured scenario that maps each attack action to the expected detection, log source, and alert, so the exercise produces measurable detection coverage data rather than just pass/fail results.