Skip to main content
Who is this for? MSP/MSSP Partners, SOC Leaders, and Security Team Leadership
March 2026 · ContraForce Team · 4 min read Every security team builds institutional knowledge over years of operational experience. Classification criteria. Response procedures. Escalation paths. Remediation steps. That knowledge lives in documents scattered across SharePoint, Confluence, Google Drive, and shared folders. Until today, none of it was accessible to your Security Delivery Agents. That changes now.

​
Introducing the SOP Knowledge Base

The SOP Knowledge Base is a new capability inside ContraForce that lets you upload your Standard Operating Procedures and associate them directly with Security Delivery Agents. Two SOP types. Two purposes. Classification SOPs define how incidents get categorized and prioritized. You can associate multiple Classification SOPs with a Security Delivery Agent, but only one is activated per investigation — ensuring consistent severity decisions while giving you flexibility across different scenarios. Response SOPs define how incidents get investigated and remediated. Each Security Delivery Agent supports multiple Response SOPs, so the right procedures are available regardless of incident type. Upload your documents. Tag them. Map them to MITRE ATT&CK techniques. Associate them with the agents that need them. Done.

​
Why This Matters

Security Delivery Agents are powerful. They triage, investigate, enrich, and recommend actions at machine speed. But speed without context is not delivery. It is automation. Delivery means the agent follows your procedures. It classifies incidents the way your team classifies them. It responds the way your team responds. It applies the institutional knowledge your analysts have built over years. The SOP Knowledge Base bridges that gap. Your agents stop operating with generic patterns and start operating with your patterns. For MSPs and MSSPs managing multiple tenants, this is the difference between a tool that runs fast and a platform that delivers consistently. Every workspace gets its own SOP library. Every agent gets the procedures that match the client’s requirements. Every incident gets handled according to the SOPs you defined.

​
How It Works

The SOP Knowledge Base lives inside the ContraForce Agent Center as a dedicated section in the left navigation. Upload. Drag and drop your SOP documents. Launch formats include Markdown and plain text, with PDF, Word, HTML, and RTF coming soon. ContraForce extracts and indexes the content automatically. Categorize. Assign each SOP as either Classification or Response. Add tags for organization. Map to MITRE ATT&CK techniques so the right SOP surfaces for the right threat. Associate. Link SOPs to Security Delivery Agents from either direction. Navigate from the SOP detail view to add agents, or from the agent detail page to add SOPs. Changes take effect immediately. View. Read SOP content directly inside ContraForce without switching to external systems. See which agents use each SOP. See which SOPs each agent has. Full visibility into the connection between your procedures and your delivery. All SOP data is workspace-scoped. Tenant isolation is enforced at the infrastructure level. No cross-tenant data exposure. No shared indexes.

​
What This Unlocks

This release is the foundation for SOP-aware agent execution. Security Delivery Agents now have access to your procedures at runtime, enabling context-aware incident handling that follows your organization’s specific guidelines. For teams already running ContraForce:
  • Your agents get smarter without retraining. Upload the SOPs. Associate them. The agents reference them during incident handling.
  • New analyst onboarding accelerates. The SOPs that define how your team operates are now embedded in the platform, not buried in a folder.
  • Governance gets concrete. Auditors and clients can see exactly which procedures govern each agent’s decisions.
For MSPs evaluating ContraForce:
  • This is how you standardize delivery across every client without building custom runbooks per tenant.
  • This is how you prove to clients that their security operations follow documented, auditable procedures.
  • This is how you scale a security practice without scaling tribal knowledge.

​
Built for the Way You Already Work

You do not need to rewrite your SOPs. You do not need to learn a proprietary format. Upload the documents your team already maintains. ContraForce handles the parsing, indexing, and association. At launch, ContraForce supports Markdown and plain text files — the formats security teams already use for version-controlled docs and lightweight playbooks. Support for Word, PDF, HTML, and RTF is coming soon.

​
Available Now

The SOP Knowledge Base is available to all ContraForce customers as part of the Phase 2: Trust and Control release. No additional cost. No configuration required. Log in to Agent Center and start uploading. Security Delivery Agents work on their first alert from any connected tool. Now they work on that first alert with your SOPs guiding every decision. AI that acts. Humans who decide. Now with your procedures built in.
Ready to see it in your tenant? Book a demo or reach out to your ContraForce account representative.

SOP Knowledge Base Documentation

Full setup guide, file formats, association workflows, and best practices.

Introducing Security Delivery Agents

Learn how Security Delivery Agents automate incident response at scale.