A 311 SOC wants orchestration that tags each simulated action with an exercise-ID for alert correlation. What correlation practice does that enable?

Tagging automated offensive actions with exercise-IDs for clean civic SIEM correlation during purple tests is the correlation practice a 311 SOC needs. Exercise identifiers act as a permit stamp on every simulated action so analysts can filter drill traffic, measure detection coverage, and avoid treating authorized tests as mystery production incidents. Clean tags also enable after-action joins between orchestration logs, SIEM alerts, and IR tickets without manual archaeology. Grouping exercise-IDs tagged alerts by MITRE technique for adversary tactic tracking during purple tests fails by concept: it assumes exercise-ID correlation already exists and adds tactic grouping on top, so it describes downstream analysis rather than the tagging practice that creates the clean join key between orchestration logs, SIEM alerts, and IR tickets. Forwarding exercise-IDs tagged telemetry to dedicated SIEM index for isolated review during purple tests fails by concept: isolating drill traffic in its own index prevents the cross-source correlation with production SIEM events and IR tickets that exercise-ID tagging is meant to enable. Tagging simulated defensive detections with exercise-IDs for clean civic SIEM correlation during purple tests fails by source: it tags the defensive detections rather than the automated offensive actions the orchestration creates, so the exercise-ID is missing at the source and cannot create the clean join key between orchestration logs, SIEM alerts, and IR tickets. Exam caveat: exercise tags must not leak into citizen-facing logs or public status pages in ways that expose internal tooling details; tagging is for SOC correlation, not public disclosure. Operational check: pick one orchestrated action, find its exercise-ID in the automation log, confirm the same ID appears on the SIEM event and IR ticket, and verify production incidents never inherit that ID.