Runs full Purple flow: scope → Red attack → Blue check → fix → re-test. Use when the user says Purple Team, Purple exercise, run Purple, or requests Red+Blue coordinated exercise.
When user says Purple Team, Purple exercise, run Purple, or Red+Blue:
docs/agents/purple-team-protocol.mdred-team-skill for technique mapping and output formatblue-team-skill for output formatdocs/agents/data-sets/security-exercises/artifacts/docs/agents/data-sets/security-exercises/YYYY-MM-DD-purple-<target>.mddocs/agents/security-team-proof-of-work.md| Step | Agent | Action |
|---|---|---|
| 1 | User/Lead | Scope |
| 2 | Red | Attack with technique IDs |
| 3 | Blue | Check alarms; map to techniques |
| 4 | Blue | Fix if missed |
| 5 | Red | Re-test (optional) |