A city red/blue working group stores emulation plans as versioned YAML beside detection rules. What benefit does that practice provide?

A city red/blue working group that stores emulation plans as versioned YAML beside detection rules treats those definitions as code artifacts civic purple teams can review, diff, and align with detections. Co-location and version control make changes reviewable in the same municipal engineering process used for Sigma or other detection-as-code, improve audit history, and reduce drift between what is emulated and what is detected. Emulation becomes a governed artifact, not a tribal spreadsheet.

Why the other options fail by concept: Claiming the practice keeps emulation results as code evidence that civic purple teams can collect, attest, and submit for audits confuses emulation plans with result evidence — storing YAML beside detections enables review and alignment, not collecting and attesting results for audits. Saying it renders emulation timelines as code graphs that civic purple teams can visualize, share, and brief to leadership is wrong; versioned YAML plans are human-readable definitions for review and alignment, not visual graphs for leadership briefings. Claiming it manages emulation schedules as code tasks that civic purple teams can assign, track, and close as exercises goes beyond simply storing emulation plans as versioned YAML beside detection rules; the practice itself is about review and alignment, not assigning, tracking, and closing exercises.

Exam caveat: versioned YAML enables review but does not automatically execute safely—promotion still needs testing, authorization, and blast-radius controls. Operational check: keep emulation YAML next to related detections in the city repo, require PR review from purple/blue owners, diff technique coverage when detections change, and remember that versioned YAML alone does not assign, track, and close exercises.