Operating Procedures

Upload your team’s operating procedures directly into ContraForce, then associate them with AI Agents so every incident is handled according to your organization’s specific policies. You’ll find Operating Procedures in the Agent Center section of the left navigation menu.

---

​

Operating Procedure Types

ContraForce supports two types of operating procedures, each designed for a different phase of incident handling.

​

Classification Operating Procedures

Classification operating procedures define how incidents should be categorized and prioritized. These contain your organization’s specific severity definitions, escalation criteria, and triage procedures. Each AI Agent can have multiple Classification operating procedures associated with it, but only one Classification operating procedure is activated per investigation. This ensures that every incident processed by that Agent follows a single, consistent classification standard while giving you the flexibility to maintain several classification approaches for different scenarios.

​

Response Operating Procedures

Response operating procedures cover how to respond to and remediate security incidents. These include containment steps, investigation workflows, communication protocols, and recovery steps. Each AI Agent can have multiple Response operating procedures associated with it, and each Response operating procedure can be shared across multiple Agents. This many-to-many relationship means you can assign your phishing response playbook to three different Agents without duplicating the document.

---

​

Supported File Formats

You can upload the following document formats: Additional formats (PDF, Word, HTML, RTF) are coming soon. Maximum file size is 10 MB per document.

---

​

Uploading an Operating Procedure

---

​

Viewing Operating Procedure Content

After uploading, you can view the full content of any operating procedure directly within ContraForce without switching to an external application.

1. Open Agent Center → Operating Procedures.
2. Click on any operating procedure in the list to open the detail view.
3. The detail panel displays the extracted document content, metadata (type, tags, MITRE ATT&CK mappings, version), and timestamps.

You can also download the original file at any time from the detail view.

---

​

Associating Operating Procedures with AI Agents

You can create these associations from either direction.

​

From the operating procedure detail page

1. Open the operating procedure you want to associate.
2. Select the Linked Agents tab.
3. Click Add Agent and select one or more AI Agents from the list.
4. The association takes effect immediately.

​

From the Agent detail page

1. Navigate to Agent Center and select the Agent you want to configure.
2. Scroll to the Associated Operating Procedures section.
3. Click Add Operating Procedure and select the ones you want to associate.
4. You can associate multiple Classification operating procedures with an Agent, but only one will be activated per investigation.

---

​

Updating an Operating Procedure

In-place editing is not supported. To update an operating procedure, upload a new version of the file. All existing Agent associations are preserved when you update the document. Use the version field on the operating procedure to track changes over time.

---

​

Searching and Filtering Operating Procedures

The operating procedure list view provides several ways to find the right document quickly:

• Search by title or content keywords.
• Filter by type to show only Classification or Response operating procedures.
• Sort by last updated date, title, or associated agent count.

Each card in the list displays the type, associated agent count, tags, and last updated timestamp.

---

​

Roles and Permissions

Operating procedure access follows the ContraForce role-based access control model.

---

​

How AI Agents Use Operating Procedures

When an AI Agent processes an incident, it retrieves the content from its associated operating procedures to inform its investigation and response decisions. This means the Agent follows your organization’s specific procedures rather than relying on generic response patterns.

• Classification operating procedures guide how the Agent categorizes incident severity and priority.
• Response operating procedures guide the specific containment, investigation, and remediation steps the Agent recommends or executes.

---

​

Best Practices

Start with your most critical playbooks. Upload the operating procedures your team uses most frequently first, such as phishing response, ransomware containment, and business email compromise procedures. Use tags consistently. Apply tags like phishing, ransomware, insider-threat, or data-exfiltration so they are easy to find and can be matched to relevant incidents. Map to MITRE ATT&CK techniques. Associating operating procedures with specific techniques helps surface the right procedure when an incident involves those techniques. Keep each procedure focused. Rather than uploading one massive document covering everything, split your procedures by incident type or response phase. This makes Agent associations more precise and retrieval more effective. Review and update regularly. Upload new versions as your procedures evolve. ContraForce preserves all Agent associations when you update a document.

---

​

Frequently Asked Questions

---

​

Related Guides

---

Questions about Operating Procedures? Contact us at support@contraforce.com.