Security Delivery Agents follow a three-phase adoption model: manual execution, automatic execution based on severity, and automatic gamebook execution. This progressive approach helps you build confidence in agent behavior before enabling full automation.
What Can You Do Here?
Run Manual Investigations
Trigger agent analysis on individual incidents
Automate by Severity
Configure agents to run automatically based on incident status
Enable Gamebook Execution
Allow agents to execute response playbooks automatically
Set Confidence Thresholds
Control when automated actions are permitted
Apply a True-Positive Policy
Use Advanced mode to act differently per classification
Prerequisites
Before configuring Security Delivery Agents, ensure you meet the following requirements.| Requirement | Description |
|---|---|
| Agent Center Deployed | Azure AI Foundry infrastructure must be provisioned |
| ContraForce Roles | Organizational Admin and Workspace Owner roles required |
Phase 1: Manual Agent Execution
In this initial phase, you manually select individual incidents and trigger the agent to run investigations. This allows you to evaluate agent performance before enabling automation.Running Agent Investigation
Choose Investigation Type
Select one of the following options:
- Run Agent Investigation — Agent analyzes the incident and provides findings without taking remediation actions
- Run Agent Investigation and Response — Agent analyzes the incident and executes recommended response actions
Investigation Options
| Option | Description | When to Use |
|---|---|---|
| Run Agent Investigation | Analysis only, no response actions | When you want to review findings before taking action |
| Run Agent Investigation and Response | Analysis plus automated response | When you trust the agent to execute appropriate responses |
Phase 2: Automatic Execution Based on Severity
Once you’re comfortable with agent behavior, configure automatic execution based on incident severity and status.The status filters below are the standard configuration. To scope automatic execution to specific severities, or to switch the trigger to Manual, enable Advanced mode and use the True-Positive Policy settings. With Advanced disabled, behavior is exactly as described in this section.
Configuring Automatic Execution
Configure Status Filters
Select which incident statuses trigger automatic agent execution:
- New — Agent runs on newly created incidents
- Active — Agent runs on incidents currently being worked
- Closed — Agent runs on closed incidents for retrospective analysis
Status Filter Options
- New
- Active
- Closed
Process new incidents automatically:
- Agent triggers immediately when incidents are created
- Provides rapid initial triage and analysis
- Recommended for high-volume environments
Phase 3: Automatic Gamebook Execution
In this advanced phase, you enable the agent to automatically execute gamebooks based on confidence thresholds.Enabling Automatic Gamebook Execution
Set Confidence Level
Configure the confidence threshold that determines when the agent automatically executes gamebook actions
Understanding Confidence Levels
| Confidence Level | Behavior | Recommended For |
|---|---|---|
| High | Agent requires strong evidence before taking action | Production environments, sensitive systems |
| Medium | Balanced approach between automation and caution | Most standard deployments |
| Low | Agent takes action with less certainty | Test environments, high-volume low-risk scenarios |
Advanced Configuration: True-Positive Policy
By default, every agent investigation ends in one post-investigation flow regardless of the agent’s verdict. Advanced mode replaces that single flow with a policy that acts on the agent’s classification, so a True Positive can be escalated for analyst action while a False Positive is closed out.Advanced mode is opt-in and reversible. While it is disabled, agent behavior is exactly as described in Phases 1 to 3, with no change. Enabling it only adds the trigger and per-classification settings below.
Enabling Advanced Mode
Configure the trigger
Choose the severities the agent runs on, and a trigger mode:
- On-Queue — the agent runs automatically when a matching incident arrives.
- Manual — the agent runs only when you trigger it from the incident Actions menu.
Configure the policy per classification
For each classification, set what happens when the agent reaches that verdict (see below).
Per-Classification Policy
When Advanced mode is on, each of the four classifications has its own policy. For an explanation of the classifications themselves, see Incident Classifications.| Setting | Description |
|---|---|
| Gamebooks | Gamebooks queued for the incident when the agent reaches this classification. |
| Assignee | The owner the incident is assigned to. |
| Status | The status the incident moves to (for example, keep a True Positive open for analyst action instead of closing it). |
| Custom action | An optional webhook fired when the agent reaches this classification. Use this to escalate into your own SIEM, ticketing, or on-call tooling. |
The Custom Action Webhook
The custom action sends the Agent investigation completed event (agent.investigation.completed.v1) the moment the investigation finishes. The payload carries the agent’s verdict and the incident context, signed so your endpoint can verify it.
This event is selected here, on the classification card. It is not a broadcast subscription: only the webhook a classification card points to receives it. For the payload schema, headers, and signature verification, see Agent Investigation Completed Webhook.
Configuration Summary
- Phase 1
- Phase 2
- Phase 3
Manual Execution:
- User selects individual incidents
- User triggers agent via Actions menu
- User reviews results before any response
- Best for: Initial evaluation and building trust
Best Practices
Progress through phases sequentially
Progress through phases sequentially
Start with Phase 1 to understand agent behavior before enabling automation. Each phase builds on the previous one.
Review agent outputs during manual execution
Review agent outputs during manual execution
Use Phase 1 to validate that agent analysis aligns with your expectations and incident handling procedures.
Set conservative confidence levels initially
Set conservative confidence levels initially
Begin with higher confidence thresholds and lower them gradually based on observed accuracy.
Monitor automated actions regularly
Monitor automated actions regularly
Even with full automation enabled, periodically review agent actions to ensure expected behavior.
Document your configuration choices
Document your configuration choices
Keep records of which phases are enabled and your confidence threshold settings for troubleshooting and auditing.
Troubleshooting
Common Issues
| Issue | Possible Cause | Solution |
|---|---|---|
| Agent not processing incidents | Mode not set to On Queue | Verify Mode is set to On Queue in Agent Center |
| Gamebooks not executing | Feature not enabled | Confirm “Allow Agent to run gamebooks” is toggled on |
| Too many automated actions | Confidence threshold too low | Increase confidence level setting |
| Agent missing incidents | Status filters misconfigured | Review and adjust status filter selections |
| Investigation not starting | Missing permissions | Verify Organizational Admin and Workspace Owner roles |
| Escalation webhook not arriving | Card’s webhook deleted, paused, disabled, or unsubscribed | Check the classification card for a binding warning; fix the webhook in Developers. Skipped deliveries appear as Failed in the delivery log |
| Advanced settings have no effect | Advanced toggle disabled | Enable the Advanced toggle and save; without it the standard Phase 1 to 3 behavior applies |
If you encounter persistent issues with Security Delivery Agent configuration, contact support@contraforce.com with your configuration details and observed behavior.
Related Guides
Deploying Agent Center
Deploy Microsoft Foundry infrastructure to manage your AI agents
Understanding Gamebooks
Learn about automated SOP-driven response actions
Incident Management
Overview of incident handling in ContraForce
User Roles and Permissions
Understanding ContraForce role requirements
Agent Investigation Completed Webhook
Payload, headers, and signature verification for the custom action event
Questions about Security Delivery Agent configuration? Contact us at support@contraforce.com.