Skip to main content
The Command Dashboard is ContraForce’s mission control center—a unified dashboard that gives you complete visibility into security incidents, gamebooks queued, and human and agent actions that are audited—across all your managed tenants.
ContraForce Command

​
Overview

The Command Dashboard serves as your central hub for overseeing multiple Microsoft tenants through a single, intuitive dashboard. By default, it displays data for all onboarded tenants, with the option to customize your view by filtering specific workspaces.
The Command Dashboard is designed for MSPs, MSSPs, and security teams managing tenants and environments. All data updates in real-time as incidents are detected and resolved.

​
Dashboard Cards

The Command Dashboard features four key data cards that provide at-a-glance insights into your security posture:

Closed Incident Tracker

Displays the number of incidents based on severity and total incidents closed across workspaces. Filter workspaces to see incidents per workspace.

Incident Trends

Shows closed incident trends based on classification as well as incident rule trends based on last detections triggered over time.

Team Member Activity

See how your humans and agents are performing in one place. Track incidents managed by users based on incident severity level.

Gamebook History

View all queued gamebooks that are processing or awaiting for approval. Click any incident to review and approve gamebook runs.

​
Incidents Table

The Incidents table is the heart of the Command Dashboard, displaying all security incidents across your connected workspaces.

​
Table Columns

ColumnDescription
SeverityIncident severity level (High, Medium, Low, Informational)
WorkspaceThe tenant/workspace where the incident occurred
Incident TitleBrief description of the incident
Incident IDUnique identifier (click to view details)
Creation TimeWhen the incident was first detected
StatusCurrent state (New, Active, Closed)
OwnerAnalyst assigned to the incident

​
Filtering Options

You can filter the incidents table by:
  • Workspace — Select specific workspaces to focus on
  • Severity — Filter by High, Medium, Low, or Informational
  • Status — Show only New, Active, or Closed incidents

​
Bulk Actions

Select multiple incidents to perform bulk operations:
1

Select Incidents

Use the checkboxes to select one or more incidents
2

Choose Action

Select an action from the bulk actions menu (e.g., assign owner, change status)
3

Apply Changes

Confirm to apply the changes to all selected incidents

​
Workspace Filtering

The workspace filter at the top of the Command Dashboard allows you to customize your view:
  1. Click the Workspace Filter dropdown
  2. Select one or more workspaces to display
  3. Your selection persists as you navigate to other pages in ContraForce
Your workspace filter selection is maintained across all ContraForce pages during your session. This allows you to focus on specific customers without re-selecting filters on each page.

​
Accessing Incident Details

To view detailed information about any incident:
  1. Locate the incident in the Incidents table
  2. Click the Incident ID (hyperlinked)
  3. The Incident Details page opens with full investigation capabilities
From the Incident Details page, you can:
  • View the complete incident timeline
  • See all affected entities
  • Run Gamebook response actions
  • Add comments and update status

​
Next Steps

Incident Management

A complete workflow for triaging, investigating, and resolving incidents.

Workspace Manager

Manage workspace settings from one central location.

Incident Classifications

Learn how to properly classify incidents to improve detection accuracy.

Multi-Tenant Features

Explore all multi-tenant management capabilities.
Need help? Contact the ContraForce Support team at [email protected].