An emergency-management SOC promotes detections only after purple-team emulation confirms hits. What loop does that close?

An emergency-management SOC that promotes detections only after purple-team emulation confirms hits is closing the detection engineering loop with automated emulation that confirms civic detections before promotion. Authoring and CI fixtures prove syntactic and narrow logical correctness; purple emulation proves the detection fires on adversary-like behavior in a representative municipal environment. That closed loop prevents “rules that look good in git” from being declared production-ready without evidence they ring the bell when emergency-management systems are exercised.

Why the other options fail by concept: Closing the threat intelligence lifecycle with automated emulation that tunes civic detections before dissemination tunes detections for intel sharing, but does not prove a civic detection fired to justify promotion; dissemination is not purple-team confirmation before promotion. Closing the incident response loop with automated emulation that confirms civic playbooks before activation tests response procedures, not whether a detection rings the bell, so it does not close the detection engineering loop at issue. Closing the vulnerability management loop with automated emulation that confirms civic exposures before remediation validates exploitable weaknesses to prioritize remediation but does not validate detections against emulated attacks for promotion; exposure confirmation cannot substitute for purple confirmation before promotion.

Exam caveat: emulation must be authorized and scoped—emergency-management networks often intersect life-safety systems; use approved ranges and non-destructive techniques. Operational check: require an emulation result artifact (technique ID, time, detection fire evidence) attached to the promotion request, and refuse production sync when the civic detection did not fire on the agreed purple scenario.