> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SOP Knowledge Base

> Upload, manage, and associate Standard Operating Procedures with AI Agents to ensure consistent, policy-driven incident response.

Upload your team's Standard Operating Procedures directly into ContraForce, then associate them with AI Agents so every incident is handled according to your organization's specific policies.

<Info>
  **Who is this for?** Organizational Admins and Agent Admins who manage Security Delivery Agents and want to standardize incident classification and response procedures.
</Info>

SOP Knowledge Base is located in the **Agent Center** section of the left navigation menu.

***

## SOP Types

ContraForce supports two types of SOPs, each designed for a different phase of incident handling.

### Classification SOPs

Classification SOPs define how incidents should be categorized and prioritized. These contain your organization's specific severity definitions, escalation criteria, and triage procedures.

Each AI Agent can have **multiple** Classification SOPs associated with it, but only **one** Classification SOP is activated per investigation. This ensures that every incident processed by that Agent follows a single, consistent classification standard while giving you the flexibility to maintain several classification approaches for different scenarios.

### Response SOPs

Response SOPs contain procedures for how to respond to and remediate security incidents. These include containment steps, investigation workflows, communication protocols, and recovery procedures.

Each AI Agent can have **multiple** Response SOPs associated with it, and each Response SOP can be shared across **multiple** Agents. This many-to-many relationship means you can assign your phishing response playbook to three different Agents without duplicating the document.

***

## Supported File Formats

SOP Knowledge Base accepts the following document formats:

| Format     | Extensions |
| ---------- | ---------- |
| Markdown   | `.md`      |
| Plain Text | `.txt`     |

Additional formats (PDF, Word, HTML, RTF) are coming soon. Maximum file size is 10 MB per document.

***

## Uploading an SOP

<Steps>
  <Step title="Open SOP Knowledge Base">
    Navigate to **Agent Center** in the left navigation menu, then select **SOP Knowledge Base**.
  </Step>

  <Step title="Start the upload">
    Click the **Upload SOP** button. The upload modal will appear.
  </Step>

  <Step title="Select the SOP type">
    Choose either **Classification** or **Response** to categorize the SOP. This determines how the SOP can be associated with AI Agents.
  </Step>

  <Step title="Upload the file">
    Drag and drop your file into the upload area, or click to browse and select a file from your computer.
  </Step>

  <Step title="Add metadata">
    Enter a **title** for the SOP. Optionally, add **tags** for easier searching and organization, and map the SOP to relevant **MITRE ATT\&CK** techniques.
  </Step>

  <Step title="Save">
    Click **Save** to upload the SOP. ContraForce extracts and indexes the document content automatically.
  </Step>
</Steps>

***

## Viewing SOP Content

After uploading, you can view the full content of any SOP directly within ContraForce without switching to an external application.

1. Open **Agent Center → SOP Knowledge Base**.
2. Click on any SOP in the list to open the detail view.
3. The detail panel displays the extracted document content, metadata (type, tags, MITRE ATT\&CK mappings, version), and timestamps.

You can also download the original file at any time from the detail view.

***

## Associating SOPs with AI Agents

You can create SOP-Agent associations from either direction.

### From the SOP detail page

1. Open the SOP you want to associate.
2. Select the **Linked Agents** tab.
3. Click **Add Agent** and select one or more AI Agents from the list.
4. The association takes effect immediately.

### From the Agent detail page

1. Navigate to **Agent Center** and select the Agent you want to configure.
2. Scroll to the **Associated SOPs** section.
3. Click **Add SOP** and select the SOPs you want to associate.
4. You can associate multiple Classification SOPs with an Agent, but only one will be activated per investigation.

<Note>
  Changes to SOP-Agent associations take effect immediately. There is no separate publish or deploy step.
</Note>

***

## Updating an SOP

SOP Knowledge Base does not support in-place editing. To update an SOP, upload a new version of the file. All existing Agent associations are preserved when you update the document.

Use the **version** field on the SOP to track changes over time.

***

## Searching and Filtering SOPs

The SOP list view provides several ways to find the right document quickly:

* **Search** by SOP title or content keywords.
* **Filter by type** to show only Classification or Response SOPs.
* **Sort** by last updated date, title, or associated agent count.

Each SOP card in the list displays the SOP type, associated agent count, tags, and last updated timestamp.

***

## Roles and Permissions

SOP access follows the ContraForce role-based access control model.

| Role                                                | Permissions                                          |
| --------------------------------------------------- | ---------------------------------------------------- |
| Organizational Admin                                | Full access: create, view, update, and delete SOPs   |
| Agent Admin                                         | Create, view, and update SOPs                        |
| Workspace-level roles (Analyst, Incident Responder) | View SOPs associated with Agents they have access to |

***

## How AI Agents Use SOPs

When an AI Agent processes an incident, it retrieves the content from its associated SOPs to inform its investigation and response decisions. This means the Agent follows your organization's specific procedures rather than relying on generic response patterns.

* **Classification SOPs** guide how the Agent categorizes incident severity and priority.
* **Response SOPs** guide the specific containment, investigation, and remediation steps the Agent recommends or executes.

<Tip>
  For best results, write your SOPs with clear, structured headings and step-by-step procedures. The more structured your document, the more effectively the AI Agent can reference the relevant section during incident handling.
</Tip>

***

## Best Practices

**Start with your most critical playbooks.** Upload the SOPs your team uses most frequently first, such as phishing response, ransomware containment, and business email compromise procedures.

**Use tags consistently.** Apply tags like `phishing`, `ransomware`, `insider-threat`, or `data-exfiltration` so SOPs are easy to find and can be matched to relevant incidents.

**Map to MITRE ATT\&CK techniques.** Associating SOPs with specific techniques helps surface the right procedure when an incident involves those techniques.

**Keep SOPs focused.** Rather than uploading one massive document covering everything, break your procedures into focused SOPs by incident type or response phase. This makes Agent associations more precise and retrieval more effective.

**Review and update regularly.** Upload new versions of your SOPs as your procedures evolve. ContraForce preserves all Agent associations when you update a document.

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Is there a limit to how many SOPs I can upload?">
    There is no hard limit on the number of SOPs per workspace. We recommend organizing your SOPs thoughtfully and associating only the most relevant procedures with each Agent.
  </Accordion>

  <Accordion title="Can I associate one SOP with multiple Agents?">
    Yes. Both SOP types support many-to-many associations, so a single SOP can be linked to multiple Agents. For Classification SOPs, multiple can be associated with an Agent, but only one is activated per investigation.
  </Accordion>

  <Accordion title="What happens if I delete an SOP that is associated with an Agent?">
    The association is removed automatically. The Agent will continue to function but will no longer reference that SOP during incident handling.
  </Accordion>

  <Accordion title="Can I share SOPs across workspaces?">
    SOPs are scoped to individual workspaces. To use the same SOP in multiple workspaces, upload the document to each workspace separately.
  </Accordion>

  <Accordion title="Do I need to redeploy my Agent after associating an SOP?">
    No. SOP associations take effect immediately. There is no redeployment or restart required.
  </Accordion>
</AccordionGroup>

***

## Related Guides

<CardGroup cols={2}>
  <Card icon="robot" href="/guides/getting-started/configuring-security-delivery-agents" title="Configuring Security Delivery Agents">
    Set up and configure agents using the three-phase adoption model.
  </Card>

  <Card icon="clock-rotate-left" href="/guides/agent-center/agent-execution-history" title="Agent Execution History">
    Monitor and audit agent activity with a complete execution trail.
  </Card>

  <Card icon="server" href="/guides/onboarding/agent-center-deployment" title="Deploying Agent Center">
    Deploy the Azure AI Foundry infrastructure required for agents.
  </Card>

  <Card icon="shield-halved" href="/guides/getting-started/incident-management" title="Incident Management">
    Learn how incidents flow through ContraForce.
  </Card>
</CardGroup>

***

Questions about SOP Knowledge Base? Contact us at [support@contraforce.com](mailto:support@contraforce.com).