Skip to main content
This guide walks you through the recommended workflow for managing security incidents in ContraForce—from initial triage to resolution.
ContraForce empowers analysts to efficiently manage incidents across multiple tenants and data sources. This workflow is designed to help you resolve incidents faster and deliver better service to your customers.

​
Workflow Overview

1

Filter Workspaces

Focus on specific tenants or view all incidents across your environment
2

Assign Incidents

Route incidents to the appropriate analyst
3

Investigate

Review the incident summary, entities, timeline, and evidence
4

Respond with Gamebooks

Execute automated response actions with one click
5

Close the Incident

Document findings and close with proper classification

​
1. Workspace Filtering

The Command Page allows you to customize which incidents are displayed by filtering on Workspace, Severity, and Status. These filters persist as you navigate between pages in ContraForce.

​
Setting Your Workspace Filter

1

Open the Filter

Click the workspace dropdown menu in the top bar of the Command dashboard
2

Select Workspaces

Choose one or more workspaces to display
3

View Filtered Results

The Incidents table updates to show only data from selected workspaces
Workspace Filter Command Page

​
2. Setting Your Incident Assignees Filter

1

Open the Assignee Filter

Click the assignee dropdown menu in the top bar of the Command Page
1

Select Assignees

Choose one or more workspaces to display
1

View Filtered Results

The Incidents table updates to show only incidents from selected assignees
Workspace filter dropdown

​
Additional Filters

Beyond workspace filtering, you can further refine your view:
FilterOptionsUse Case
SeverityHigh, Medium, Low, InformationalFocus on critical incidents first
StatusNew, Active, ClosedView only incidents requiring action
ModuleSentinel, Defender for EndpointFilter by security product
When filtering by status, you’ll see statuses organized by module (Sentinel, Defender for Endpoint, etc.). This helps you quickly identify incidents by source.

​
2. Incident Assignment

Proper incident assignment ensures the right analyst handles each incident and provides clear ownership for tracking.

​
Individual Assignment

To assign a single incident:
  1. Locate the incident in the Incidents table
  2. Click the dropdown in the Owner column
  3. Select an analyst from the list of portal users

​
Handling Incidents at Scale

There’s no manual bulk-update action. Security Delivery Agents running on queue automatically triage and act on incidents in bulk as they arrive, so you don’t have to process them batch by batch. See Configuring Security Delivery Agents.

​
3. Incident Summary

The Incident Summary provides a complete view of an incident with all the context you need for investigation.

​
Accessing the Summary

Click any Incident ID in the Incidents table to open its Summary view.
Incident Summary overview

​
Incident Tabs

Summary – Overview of the incident including severity, status, affected assets, and key details at a glance.

​
4. Gamebook Responses

Gamebooks SOP driven AI-generated and human created response actions that let you quickly respond to incidents.
Available Gamebook actions are determined by the entity types present in the incident. Agents automatically suggests relevant actions based on the output of the investigation and incident classification.

​
Using Suggested Gamebooks

If a Gamebook has been previously executed for similar incidents, agents suggest it automatically:
Gamebook response panel with completed actions

​
Creating a Custom Gamebook

1

Open the Workbench

Click the dropdown next to “Edit” and select Create New Gamebook
2

Explore Available Actions

Click entity icons in the Entity Graph to see available response actions
3

Build Your Response

  • Use the arrows to navigate through action options
  • Click the green + icon to add an action
  • Click the red - icon to remove an action
4

Execute

Click Approve Gamebook to execute all selected actions

​
Gamebook Approval Workflow

Some Gamebook actions require approval before execution:
Actions with a red lock icon require approval from a user with appropriate permissions in the tenant.
To request approval:
  1. Build your Gamebook as usual
  2. Click Request Gamebook Approval (instead of Run Gamebook)
  3. The request is sent to authorized approvers
To approve a Gamebook:
  • Approvers can approve directly from the incident, or
  • Use the Gamebook Activity tab to review and approve pending requests

​
5. Incident Closure

After completing your investigation and response, close the incident with proper documentation.
Close Incident modal

​
Quick Close from Gamebook

After a Gamebook completes, a green Close Incident button appears at the bottom of the Gamebook context group.

​
Closure Fields

FieldOptionsPurpose
ClassificationTrue Positive, False Positive, Benign Positive, UndeterminedRequired. Categorizes the incident outcome
CommentFree textOptional note about why you’re closing the incident
Need help understanding classifications? See Understanding Incident Classifications for detailed guidance.

​
Putting It Together

The ContraForce incident management workflow is designed to help you:

Triage Faster

Filter and prioritize incidents across all your tenants from one dashboard

Respond Automatically

Execute proven response actions with Gamebooks instead of manual remediation

Document Everything

Maintain complete audit trails with comments, classifications, and history

Command Dashboard

Learn more about the central incident dashboard.

What are Gamebooks?

Deep dive into SOP driven automated response actions.

Workbench Overview

Learn how to manage incidents in your workbench.

Incident Classifications

Understand True Positive, False Positive, and more.
Questions about this workflow? Contact us at support@contraforce.com. We’re happy to help optimize your incident management process.