# Tutorial: validate your detections (Phase 4 assurance)

**Audience:** SOC / purple-team operators  
**Time:** ~30-45 minutes  
**Goal:** Prove canary/DET mappings, Ops de-confliction safety, SOC fixture
correlation, and fingerprint-risk sign-off: without Internet-bind clearance.

## Prerequisites

- Repo checkout with Go toolchain
- Ops GUI optional for de-confliction API drills
- Read [purple-team how-to](../how-to/purple-team.md) first

## Steps

1. **Purple-team + fingerprint-risk**

   ```bash
   make purple-team
   cat evidence/gates/purple-team/fingerprint-risk-latest.json
   ```

   Confirm `blocks_signoff` is `false` for lab scaffolding. Score ≥ threshold
   fails production-signoff (Internet-bind remains **NOT CLEARED** until
   residuals close).

2. **Persona-echo regression**

   ```bash
   go test ./engine/internal/shell/ -count=1 -run PersonaEcho
   ```

   Jailbreak primitives must fail closed; no system-prompt / persona leak in
   shell stdout fills.

3. **De-confliction (Ops post-ingest)**

   Register a window with **egress CIDR or client cert hash or BAS id**
   (time+token alone is rejected):

   ```bash
   # Example against local Ops GUI
   curl -sS -X POST "$OPS/api/agent/deconfliction/windows" -H 'Content-Type: application/json' -d '{
     "id":"win-lab","token_hash":"tok-lab",
     "start":"2026-07-30T00:00:00Z","end":"2026-07-30T23:59:59Z",
     "egress_cidrs":["198.51.100.0/24"],"capture_only":true,"owner":"purple"
   }'
   ```

   Unlisted source during the window → `deconfliction_anomaly` + page-out.
   Sensor inbound `X-CHN-Suppress` headers **never** silence emit.

4. **SOC fixture correlation**

   ```bash
   go test ./ops/internal/opsgui/socvalidate/ -count=1 -run SOCCorrelation
   ```

   Safe CEF/OCSF fixtures must match your configured DET-* rule ID list.

5. **Live-fire (external client only)**

   Schedule a drill against a **published decoy URL**. Do not use Ops→sensor
   push paths. Capture-only windows suppress page-out in Ops after ingest.

## Checklist

- [ ] `make purple-team` green; fingerprint-risk report present
- [ ] Persona-echo test green
- [ ] De-confliction rejects time+token alone; anomaly on unbound hit
- [ ] SOC correlation matches expected rule IDs
- [ ] Live-fire uses external client only
- [ ] Internet-bind still **NOT CLEARED** per [production-signoff](../assurance/production-signoff.md)

## Related

- [Purple-team how-to](../how-to/purple-team.md)
- [SOC detections](../soc/detections.md)
- [Production sign-off](../assurance/production-signoff.md)