> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Operating Procedures

> Upload, manage, and associate operating procedures with AI Agents to ensure consistent, policy-driven incident response.

Upload your team's operating procedures directly into ContraForce, then associate them with AI Agents so every incident is handled according to your organization's specific policies.

<Info>
  **Who is this for?** Organizational Admins and Agent Admins who manage Security Delivery Agents and want to standardize incident classification and response procedures.
</Info>

You'll find **Operating Procedures** in the **Agent Center** section of the left navigation menu.

***

## Operating Procedure Types

ContraForce supports two types of operating procedures, each designed for a different phase of incident handling.

### Classification Operating Procedures

Classification operating procedures define how incidents should be categorized and prioritized. These contain your organization's specific severity definitions, escalation criteria, and triage procedures.

Each AI Agent can have **multiple** Classification operating procedures associated with it, but only **one** Classification operating procedure is activated per investigation. This ensures that every incident processed by that Agent follows a single, consistent classification standard while giving you the flexibility to maintain several classification approaches for different scenarios.

### Response Operating Procedures

Response operating procedures cover how to respond to and remediate security incidents. These include containment steps, investigation workflows, communication protocols, and recovery steps.

Each AI Agent can have **multiple** Response operating procedures associated with it, and each Response operating procedure can be shared across **multiple** Agents. This many-to-many relationship means you can assign your phishing response playbook to three different Agents without duplicating the document.

***

## Supported File Formats

You can upload the following document formats:

| Format     | Extensions |
| ---------- | ---------- |
| Markdown   | `.md`      |
| Plain Text | `.txt`     |

Additional formats (PDF, Word, HTML, RTF) are coming soon. Maximum file size is 10 MB per document.

***

## Uploading an Operating Procedure

<Steps>
  <Step title="Open Operating Procedures">
    Navigate to **Agent Center** in the left navigation menu, then select **Operating Procedures**.
  </Step>

  <Step title="Start the upload">
    Click the **Upload Operating Procedure** button. The upload modal will appear.
  </Step>

  <Step title="Select the operating procedure type">
    Choose either **Classification** or **Response** to categorize the operating procedure. This determines how it can be associated with AI Agents.
  </Step>

  <Step title="Upload the file">
    Drag and drop your file into the upload area, or click to browse and select a file from your computer.
  </Step>

  <Step title="Add metadata">
    Enter a **title** for the operating procedure. Optionally, add **tags** for easier searching and organization, and map it to relevant **MITRE ATT\&CK** techniques.
  </Step>

  <Step title="Save">
    Click **Save** to upload the operating procedure. ContraForce extracts and indexes the document content automatically.
  </Step>
</Steps>

***

## Viewing Operating Procedure Content

After uploading, you can view the full content of any operating procedure directly within ContraForce without switching to an external application.

1. Open **Agent Center → Operating Procedures**.
2. Click on any operating procedure in the list to open the detail view.
3. The detail panel displays the extracted document content, metadata (type, tags, MITRE ATT\&CK mappings, version), and timestamps.

You can also download the original file at any time from the detail view.

***

## Associating Operating Procedures with AI Agents

You can create these associations from either direction.

### From the operating procedure detail page

1. Open the operating procedure you want to associate.
2. Select the **Linked Agents** tab.
3. Click **Add Agent** and select one or more AI Agents from the list.
4. The association takes effect immediately.

### From the Agent detail page

1. Navigate to **Agent Center** and select the Agent you want to configure.
2. Scroll to the **Associated Operating Procedures** section.
3. Click **Add Operating Procedure** and select the ones you want to associate.
4. You can associate multiple Classification operating procedures with an Agent, but only one will be activated per investigation.

<Note>
  Changes to these associations take effect immediately. There is no separate publish or deploy step.
</Note>

***

## Updating an Operating Procedure

In-place editing is not supported. To update an operating procedure, upload a new version of the file. All existing Agent associations are preserved when you update the document.

Use the **version** field on the operating procedure to track changes over time.

***

## Searching and Filtering Operating Procedures

The operating procedure list view provides several ways to find the right document quickly:

* **Search** by title or content keywords.
* **Filter by type** to show only Classification or Response operating procedures.
* **Sort** by last updated date, title, or associated agent count.

Each card in the list displays the type, associated agent count, tags, and last updated timestamp.

***

## Roles and Permissions

Operating procedure access follows the ContraForce role-based access control model.

| Role                                                | Permissions                                                          |
| --------------------------------------------------- | -------------------------------------------------------------------- |
| Organizational Admin                                | Full access: create, view, update, and delete operating procedures   |
| Agent Admin                                         | Create, view, and update operating procedures                        |
| Workspace-level roles (Analyst, Incident Responder) | View operating procedures associated with Agents they have access to |

***

## How AI Agents Use Operating Procedures

When an AI Agent processes an incident, it retrieves the content from its associated operating procedures to inform its investigation and response decisions. This means the Agent follows your organization's specific procedures rather than relying on generic response patterns.

* **Classification operating procedures** guide how the Agent categorizes incident severity and priority.
* **Response operating procedures** guide the specific containment, investigation, and remediation steps the Agent recommends or executes.

<Tip>
  For best results, write your operating procedures with clear, structured headings and step-by-step procedures. The more structured your document, the more effectively the AI Agent can reference the relevant section during incident handling.
</Tip>

***

## Best Practices

**Start with your most critical playbooks.** Upload the operating procedures your team uses most frequently first, such as phishing response, ransomware containment, and business email compromise procedures.

**Use tags consistently.** Apply tags like `phishing`, `ransomware`, `insider-threat`, or `data-exfiltration` so they are easy to find and can be matched to relevant incidents.

**Map to MITRE ATT\&CK techniques.** Associating operating procedures with specific techniques helps surface the right procedure when an incident involves those techniques.

**Keep each procedure focused.** Rather than uploading one massive document covering everything, split your procedures by incident type or response phase. This makes Agent associations more precise and retrieval more effective.

**Review and update regularly.** Upload new versions as your procedures evolve. ContraForce preserves all Agent associations when you update a document.

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Is there a limit to how many operating procedures I can upload?">
    There is no hard limit on the number of operating procedures per workspace. We recommend organizing them thoughtfully and associating only the most relevant procedures with each Agent.
  </Accordion>

  <Accordion title="Can I associate one operating procedure with multiple Agents?">
    Yes. Both types support many-to-many associations, so a single operating procedure can be linked to multiple Agents. For Classification operating procedures, multiple can be associated with an Agent, but only one is activated per investigation.
  </Accordion>

  <Accordion title="What happens if I delete an operating procedure that is associated with an Agent?">
    The association is removed automatically. The Agent will continue to function but will no longer reference that procedure during incident handling.
  </Accordion>

  <Accordion title="Can I share operating procedures across workspaces?">
    Operating procedures are scoped to individual workspaces. To use the same procedure in multiple workspaces, upload the document to each workspace separately.
  </Accordion>

  <Accordion title="Do I need to redeploy my Agent after associating an operating procedure?">
    No. These associations take effect immediately. There is no redeployment or restart required.
  </Accordion>
</AccordionGroup>

***

## Related Guides

<CardGroup cols={2}>
  <Card icon="robot" href="/guides/getting-started/configuring-security-delivery-agents" title="Configuring Security Delivery Agents">
    Set up and configure agents using the three-phase adoption model.
  </Card>

  <Card icon="clock-rotate-left" href="/guides/agent-center/agent-execution-history" title="Agent Execution History">
    Monitor and audit agent activity with a complete execution trail.
  </Card>

  <Card icon="server" href="/guides/onboarding/agent-center-deployment" title="Deploying Agent Center">
    Deploy the Azure AI Foundry infrastructure required for agents.
  </Card>

  <Card icon="shield-halved" href="/guides/getting-started/incident-management" title="Incident Management">
    Learn how incidents flow through ContraForce.
  </Card>
</CardGroup>

***

Questions about Operating Procedures? Contact us at [support@contraforce.com](mailto:support@contraforce.com).