Walk through the engagement chronologically - Red team reveals what they did and why - Blue team shares what they detected and what they missed - Collaborative discussion of detection improvement opportunities - This is NOT about blame. It is about learning and improvement.