SOP Knowledge Base

Upload your team’s Standard Operating Procedures directly into ContraForce, then associate them with AI Agents so every incident is handled according to your organization’s specific policies. SOP Knowledge Base is located in the Agent Center section of the left navigation menu.

---

​

SOP Types

ContraForce supports two types of SOPs, each designed for a different phase of incident handling.

​

Classification SOPs

Classification SOPs define how incidents should be categorized and prioritized. These contain your organization’s specific severity definitions, escalation criteria, and triage procedures. Each AI Agent can have multiple Classification SOPs associated with it, but only one Classification SOP is activated per investigation. This ensures that every incident processed by that Agent follows a single, consistent classification standard while giving you the flexibility to maintain several classification approaches for different scenarios.

​

Response SOPs

Response SOPs contain procedures for how to respond to and remediate security incidents. These include containment steps, investigation workflows, communication protocols, and recovery procedures. Each AI Agent can have multiple Response SOPs associated with it, and each Response SOP can be shared across multiple Agents. This many-to-many relationship means you can assign your phishing response playbook to three different Agents without duplicating the document.

---

​

Supported File Formats

SOP Knowledge Base accepts the following document formats: Additional formats (PDF, Word, HTML, RTF) are coming soon. Maximum file size is 10 MB per document.

---

​

Uploading an SOP

---

​

Viewing SOP Content

After uploading, you can view the full content of any SOP directly within ContraForce without switching to an external application.

1. Open Agent Center → SOP Knowledge Base.
2. Click on any SOP in the list to open the detail view.
3. The detail panel displays the extracted document content, metadata (type, tags, MITRE ATT&CK mappings, version), and timestamps.

You can also download the original file at any time from the detail view.

---

​

Associating SOPs with AI Agents

You can create SOP-Agent associations from either direction.

​

From the SOP detail page

1. Open the SOP you want to associate.
2. Select the Linked Agents tab.
3. Click Add Agent and select one or more AI Agents from the list.
4. The association takes effect immediately.

​

From the Agent detail page

1. Navigate to Agent Center and select the Agent you want to configure.
2. Scroll to the Associated SOPs section.
3. Click Add SOP and select the SOPs you want to associate.
4. You can associate multiple Classification SOPs with an Agent, but only one will be activated per investigation.

---

​

Updating an SOP

SOP Knowledge Base does not support in-place editing. To update an SOP, upload a new version of the file. All existing Agent associations are preserved when you update the document. Use the version field on the SOP to track changes over time.

---

​

Searching and Filtering SOPs

The SOP list view provides several ways to find the right document quickly:

• Search by SOP title or content keywords.
• Filter by type to show only Classification or Response SOPs.
• Sort by last updated date, title, or associated agent count.

Each SOP card in the list displays the SOP type, associated agent count, tags, and last updated timestamp.

---

​

Roles and Permissions

SOP access follows the ContraForce role-based access control model.

---

​

How AI Agents Use SOPs

When an AI Agent processes an incident, it retrieves the content from its associated SOPs to inform its investigation and response decisions. This means the Agent follows your organization’s specific procedures rather than relying on generic response patterns.

• Classification SOPs guide how the Agent categorizes incident severity and priority.
• Response SOPs guide the specific containment, investigation, and remediation steps the Agent recommends or executes.

---

​

Best Practices

Start with your most critical playbooks. Upload the SOPs your team uses most frequently first, such as phishing response, ransomware containment, and business email compromise procedures. Use tags consistently. Apply tags like phishing, ransomware, insider-threat, or data-exfiltration so SOPs are easy to find and can be matched to relevant incidents. Map to MITRE ATT&CK techniques. Associating SOPs with specific techniques helps surface the right procedure when an incident involves those techniques. Keep SOPs focused. Rather than uploading one massive document covering everything, break your procedures into focused SOPs by incident type or response phase. This makes Agent associations more precise and retrieval more effective. Review and update regularly. Upload new versions of your SOPs as your procedures evolve. ContraForce preserves all Agent associations when you update a document.

---

​

Frequently Asked Questions

---

​

Related Guides

---

Questions about SOP Knowledge Base? Contact us at support@contraforce.com.