Security Delivery Agents follow a three-phase adoption model: manual execution, automatic execution based on severity, and automatic Gamebook execution. This progressive approach helps you build confidence in agent behavior before enabling full automation.
What Can You Do Here?
Run Manual Investigations
Trigger agent analysis on individual incidents
Automate by Severity
Configure agents to run automatically based on incident status
Enable Gamebook Execution
Allow agents to execute response playbooks automatically
Set Confidence Thresholds
Control when automated actions are permitted
Apply a True-Positive Policy
Use Advanced mode to act differently per classification
Prerequisites
Before configuring Security Delivery Agents, ensure you meet the following requirements.Phase 1: Manual Agent Execution
In this initial phase, you manually select individual incidents and trigger the agent to run investigations. This allows you to evaluate agent performance before enabling automation.Running Agent Investigation
1
Open an Incident
Navigate to the incident you want to investigate
2
Access Actions Menu
Select Actions from the incident toolbar
3
Choose Investigation Type
Select one of the following options:
- Run Agent Investigation — Agent analyzes the incident and provides findings without taking remediation actions
- Run Agent Investigation and Response — Agent analyzes the incident, compiles a Gamebook from the entities it identifies, and executes the recommended response actions
4
Review Results
Examine the agent’s findings and recommendations
Investigation Options
Phase 2: Automatic Execution Based on Severity
Once you’re comfortable with agent behavior, switch the severities you want handled automatically to On Queue. On Queue is fully autonomous: the agent picks up incidents of that severity as they arrive. New agents default to On Queue.Configuring Automatic Execution
1
Open the Agent
Select Agents in the left navigation to open the Agent Center, then configure the agent from the Agents tab
2
Set Mode to On Queue
On each severity card (High, Medium, Low, Info), set Mode to On Queue for the severities the agent should process on its own. Leave the others on Manual
3
Choose What Happens After a Run
Set Status after run (No Change, Active, New, or Closed) and turn on Assign agent to incident if the agent should become the incident’s owner
4
Save Configuration
Select Save configuration
Per-Severity Settings
On Queue decides whether the agent picks up a severity on its own. To limit when it does, set working hours with Agent Shifts; outside a shift, new incidents wait for your team.
With Advanced options on, Status after run and Assign agent to incident move from the severity cards to a per-classification policy. See Advanced Configuration.
Phase 3: Automatic Gamebook Execution
In this advanced phase, you enable the agent to automatically execute Gamebooks based on confidence thresholds.How the Agent Compiles a Gamebook
Before it executes anything, the agent builds an investigation graph of the incident — the same Entity Context Graph you see in the Workbench — to determine which users, devices, IPs, files, and emails the incident impacted. It then compiles the Gamebook by mapping the appropriate response actions to each impacted entity, based on entity type and the incident’s classification. The confidence threshold below decides whether that compiled Gamebook runs automatically or waits for you.Enabling Automatic Gamebook Execution
1
Open the Agent
Select Agents in the left navigation to open the Agent Center, then configure the agent from the Agents tab
2
Enable Gamebook Execution
On each severity card, turn on Allow agent to run gamebooks
3
Set Confidence to Respond
Drag the Confidence to respond slider (0–100) to the confidence the agent needs before it runs Gamebook actions
4
Save Configuration
Apply your settings to activate automatic Gamebook execution
Understanding Confidence to Respond
Confidence to respond is set per severity on a 0–100 scale. The agent runs Gamebook actions only when its confidence meets the threshold; below it, it leaves the actions for an analyst. A higher threshold is more conservative. Each agent investigation comment also shows the agent’s malicious confidence (0–100) for the incident. Workspace Gamebook run policies (Workspaces → [workspace] → Gamebooks) still apply, so an action can be blocked or sent to an approver even when the agent is confident. See Workspace Policies.Advanced Configuration: True-Positive Policy
By default, every agent investigation ends in one post-investigation flow regardless of the agent’s verdict. Advanced mode replaces that single flow with a policy that acts on the agent’s classification, so a True Positive can be escalated for analyst action while a False Positive is closed out.Advanced mode is opt-in and reversible. While it is disabled, agent behavior is exactly as described in Phases 1 to 3, with no change. Enabling it only adds the trigger and per-classification settings below.
Enabling Advanced Mode
1
Open Agent Configuration
Select Agents in the left navigation to open the Agent Center, then configure the agent from the Agents tab.
2
Turn on Advanced
Turn on Advanced options. The Classification policy cards appear below the severity cards.
3
Configure the severities
Severity still drives the agent’s Mode (On Queue or Manual), Allow agent to run gamebooks, and Confidence to respond on each severity card.
4
Configure the policy per classification
For each classification, set what happens when the agent reaches that verdict (see below).
5
Save
Apply your settings. Save is blocked until the webhook list has loaded, so a policy is never saved against an unverified webhook.
Per-Classification Policy
When Advanced mode is on, each of the four classifications has its own policy. For an explanation of the classifications themselves, see Incident Classifications.The Custom Action Webhook
The custom action sends the Agent investigation completed event (agent.investigation.completed.v1) the moment the investigation finishes. The payload carries the agent’s verdict and the incident context, signed so your endpoint can verify it.
This event is selected here, on the classification card. It is not a broadcast subscription: only the webhook a classification card points to receives it. For the payload schema, headers, and signature verification, see Agent Investigation Completed Webhook.
Configuration Summary
- Phase 1
- Phase 2
- Phase 3
Manual Execution:
- User selects individual incidents
- User triggers agent via Actions menu
- User reviews results before any response
- Best for: Initial evaluation and building trust
Best Practices
Progress through phases sequentially
Progress through phases sequentially
Start with Phase 1 to understand agent behavior before enabling automation. Each phase builds on the previous one.
Review agent outputs during manual execution
Review agent outputs during manual execution
Use Phase 1 to validate that agent analysis aligns with your expectations and incident handling procedures.
Set conservative confidence levels initially
Set conservative confidence levels initially
Begin with higher confidence thresholds and lower them gradually based on observed accuracy.
Monitor automated actions regularly
Monitor automated actions regularly
Even with full automation enabled, periodically review agent actions to ensure expected behavior.
Document your configuration choices
Document your configuration choices
Keep records of which phases are enabled and your confidence threshold settings for troubleshooting and auditing.
Troubleshooting
Common Issues
If you encounter persistent issues with Security Delivery Agent configuration, contact support@contraforce.com with your configuration details and observed behavior.
Related Guides
Deploying Agent Center
Deploy Microsoft Foundry infrastructure to manage your AI agents
Understanding Gamebooks
Learn about automated response actions guided by your operating procedures
Operating Procedures
Link Classification and Response operating procedures to agents so they follow your policies
Incident Management
Overview of incident handling in ContraForce
User Roles and Permissions
Understanding ContraForce role requirements
Agent Investigation Completed Webhook
Payload, headers, and signature verification for the custom action event
Questions about Security Delivery Agent configuration? Contact us at support@contraforce.com.