SOPs for Security Delivery Agents

Upload your team’s standard operating procedures (SOPs) directly into ContraForce, then associate them with AI Agents so every incident is handled according to your organization’s specific policies. Select SOPs in the left navigation menu. The page has three tabs: My SOPs (your library), Templates (ready-made procedures to start from), and Audit (a history of changes).

---

​

SOP Types

ContraForce supports two types of SOPs, each designed for a different phase of incident handling.

​

Classification SOPs

Classification SOPs define how incidents should be categorized and prioritized. These contain your organization’s specific severity definitions, escalation criteria, and triage procedures. Each AI Agent can have multiple Classification SOPs associated with it, but only one Classification SOP is activated per investigation. This ensures that every incident processed by that Agent follows a single, consistent classification standard while giving you the flexibility to maintain several classification approaches for different scenarios.

​

Response SOPs

Response SOPs cover how to respond to and remediate security incidents. These include containment steps, investigation workflows, communication protocols, and recovery steps. Each AI Agent can have multiple Response SOPs associated with it, and each Response SOP can be shared across multiple Agents. This many-to-many relationship means you can assign your phishing response playbook to three different Agents without duplicating the document.

---

​

Supported File Formats

You can upload the following document formats: Additional formats (PDF, Word, HTML, RTF) are coming soon. Maximum file size is 10 MB per document.

---

​

Uploading an SOP

---

​

Viewing SOP Content

After uploading, you can view the full content of any SOP directly within ContraForce without switching to an external application.

1. Open SOPs from the left navigation menu.
2. Click on any SOP in the list to open the detail view.
3. The detail panel displays the extracted document content, metadata (type, tags, MITRE ATT&CK mappings, version), and timestamps.

You can also download the original file at any time from the detail view.

---

​

Associating SOPs with AI Agents

You can create these associations from either direction.

​

From the SOP detail page

1. Open the SOP you want to associate.
2. Select the Linked Agents tab.
3. Click Add Agent and select one or more AI Agents from the list.
4. The association takes effect immediately.

​

From the Agent detail page

1. Select Agents in the left navigation (the Agent Center) and configure the agent from the Agents tab.
2. Select the SOPs tab. It lists the agent’s Classification SOP and Response SOPs.
3. Select Manage in SOPs to associate SOPs from the SOPs page.
4. You can associate multiple Classification SOPs with an Agent, but only one will be activated per investigation.

---

​

Updating an SOP

In-place editing is not supported. To update an SOP, upload a new version of the file. All existing Agent associations are preserved when you update the document. Use the version field on the SOP to track changes over time.

---

​

Searching and Filtering SOPs

The SOP list view provides several ways to find the right document quickly:

• Search by title or content keywords.
• Filter by type to show only Classification or Response SOPs.
• Sort by last updated date, title, or associated agent count.

Each card in the list displays the type, associated agent count, tags, and last updated timestamp.

---

​

Roles and Permissions

SOP access follows the ContraForce role-based access control model.

---

​

How AI Agents Use SOPs

When an AI Agent processes an incident, it retrieves the content from its associated SOPs to inform its investigation and response decisions. This means the Agent follows your organization’s specific procedures rather than relying on generic response patterns.

• Classification SOPs guide how the Agent categorizes incident severity and priority.
• Response SOPs guide the specific containment, investigation, and remediation steps the Agent recommends or executes.

---

​

Best Practices

Start with your most critical playbooks. Upload the SOPs your team uses most frequently first, such as phishing response, ransomware containment, and business email compromise procedures. Use tags consistently. Apply tags like phishing, ransomware, insider-threat, or data-exfiltration so they are easy to find and can be matched to relevant incidents. Map to MITRE ATT&CK techniques. Associating SOPs with specific techniques helps surface the right procedure when an incident involves those techniques. Keep each procedure focused. Rather than uploading one massive document covering everything, split your procedures by incident type or response phase. This makes Agent associations more precise and retrieval more effective. Review and update regularly. Upload new versions as your procedures evolve. ContraForce preserves all Agent associations when you update a document.

---

​

Frequently Asked Questions

---

​

Related Guides

---

Questions about SOPs? Contact us at support@contraforce.com.