# ContraForce

> Documentation for ContraForce, the AI-powered security delivery platform for MSPs, MSSPs, and SOC teams: onboarding, incident response, Gamebooks, agents, and the API.

- [Security Delivery Platform Documentation](https://docs.contraforce.com/overview.md): Use the ContraForce documentation to onboard workspaces, triage incidents, run Gamebooks, and connect Microsoft Sentinel and Defender for Endpoint.
- [Command Dashboard: SOC Metrics Across Workspaces](https://docs.contraforce.com/guides/getting-started/command-dashboard.md): Track closed incidents, classification trends, detection rule activity, and Gamebook runs across all your workspaces in one multi-tenant SOC dashboard.
- [Quick Actions: Command Palette (Ctrl + K)](https://docs.contraforce.com/guides/getting-started/quick-actions.md): Use the Ctrl + K keyboard shortcut to open Quick Actions, a command palette that takes you to portal pages, workspace settings, and common tasks.
- [Workspace Center: Manage Customer Workspaces](https://docs.contraforce.com/guides/getting-started/workspace-manager.md): Manage customer workspaces in the Workspace Center: pre-onboard customers, monitor health, configure modules, grant consent, and set Gamebook approvers.
- [Workspace Environments: Endpoints and Licenses](https://docs.contraforce.com/guides/getting-started/workspace-environments.md): Review a workspace's endpoint and license inventory, find devices not yet onboarded to Defender, and see which response actions each connection supports.
- [Content Management System: Detection Rules](https://docs.contraforce.com/guides/getting-started/content-management-system.md): Manage a workspace's Microsoft Sentinel analytics rules and Defender XDR custom detections: search, add, and bulk enable, disable, or delete rules.
- [Security Incident Management: Triage to Closure](https://docs.contraforce.com/guides/getting-started/incident-management.md): Triage, assign, investigate, and close security incidents across your workspaces, with bulk close and reassign, Gamebook responses, and approval workflows.
- [Incident Report: Closed Incidents and PDF Export](https://docs.contraforce.com/guides/getting-started/incident-report.md): Open the closed incidents behind a Command Dashboard total, filter by classification, severity, source, or reason, and save a PDF copy for a customer.
- [Incident SLA Tracking: First Response and MTTR](https://docs.contraforce.com/guides/getting-started/sla-tracking.md): Set incident SLA targets per workspace and severity, then track Time to First Response and MTTR as live countdowns, with an at-risk threshold you choose.
- [How to Classify Incidents: True vs False Positive](https://docs.contraforce.com/guides/getting-started/incident-classifications.md): Choose a classification when you close an incident: True Positive, Benign Positive, False Positive, or Undetermined, with examples and a decision tree.
- [Multi-Tenant Security for MSPs and MSSPs](https://docs.contraforce.com/guides/getting-started/multi-tenant-features.md): See incidents, Gamebook activity, and approvals for every customer workspace in one place. Multi-tenant security management built for MSPs and MSSPs.
- [Workbench: Incident Investigation and Response](https://docs.contraforce.com/guides/getting-started/workbench-overview.md): Use the Workbench for incident investigation and response: explore affected entities in the Entity Context Graph, then build, approve, and run Gamebooks.
- [Log Search: Run KQL Queries on Workspace Logs](https://docs.contraforce.com/guides/getting-started/log-search.md): Query a workspace's logs with KQL in ContraForce, browse the schema, export results, and let Ask IRIS turn a plain-language question into KQL.
- [What Are Gamebooks? No-Code Incident Response](https://docs.contraforce.com/guides/getting-started/what-are-gamebooks.md): Gamebooks are no-code incident response workflows guided by your operating procedures. Run one to isolate endpoints, reset MFA, block IPs, or delete email.
- [Workspace Policies for Gamebooks and Agents](https://docs.contraforce.com/guides/getting-started/workspace-policies.md): Set ordered allow, block, and approval policies per workspace to control which Gamebook response actions run and which incidents your agents investigate.
- [Platform Permissions: Microsoft Entra ID Consent](https://docs.contraforce.com/guides/getting-started/platform-permissions-and-consent.md): See which Microsoft Entra ID apps ContraForce uses, what each one does, and which admin roles can grant core consent at sign-in and module consent later.
- [Onboarding Overview for MSPs and Customers](https://docs.contraforce.com/onboarding-customer-workspaces.md): See how ContraForce onboarding works for MSPs and customer admins: what each side needs, which modules to pre-select, and how to confirm go-live.
- [MSP and MSSP Platform Onboarding](https://docs.contraforce.com/guides/onboarding/platform-onboarding.md): Onboard your MSP or MSSP organization: grant Microsoft Entra admin consent, set up your Agent Center, connect detection sources, and pre-onboard customers.
- [Customer Workspace Onboarding](https://docs.contraforce.com/guides/onboarding/customer-workspace-onboarding.md): Finish customer workspace onboarding: open your invite link, grant the ContraForce API and Portal consents, consent each module, and fix sign-in failures.
- [Onboarding Admin Roles and App Permissions](https://docs.contraforce.com/guides/onboarding/workspace-onboarding.md): See which Microsoft Entra roles can grant ContraForce admin consent, when you need Subscription Owner, and the permissions each enterprise app requests.
- [Deploying Agent Center with Microsoft Foundry](https://docs.contraforce.com/guides/onboarding/agent-center-deployment.md): Deploy Agent Center to set up Microsoft Foundry for Security Delivery Agents. You need Azure Subscription Owner plus Organizational Admin or Agent Admin.
- [Configuring Security Delivery Agents](https://docs.contraforce.com/guides/getting-started/configuring-security-delivery-agents.md): Configure Security Delivery Agents to investigate on demand or On Queue by severity, run Gamebooks at a confidence threshold, and escalate True Positives.
- [User and Group Management for MSPs and MSSPs](https://docs.contraforce.com/guides/onboarding/user-group-management-for-providers.md): Manage users and groups as an MSP or MSSP: create organization groups once, assign them roles in each customer workspace, and troubleshoot access.
- [Email Notifications for Incidents and Gamebooks](https://docs.contraforce.com/guides/onboarding/notifications-module.md): Set up email notifications for Microsoft Sentinel incidents and Gamebook runs, see what each module supports, and route them to a team inbox or ITSM tool.
- [Microsoft Sentinel Incident Email Notifications](https://docs.contraforce.com/guides/technical/notifications-configuration.md): Choose which Microsoft Sentinel incident severities send email notifications in each workspace, route them to distribution groups, and track Gamebook runs.
- [Microsoft Sentinel Module Deployment](https://docs.contraforce.com/guides/onboarding/microsoft-sentinel-module.md): Deploy the Microsoft Sentinel module: one consent sets up Azure Lighthouse and incident streaming so you can manage analytics rules and hunt with KQL.
- [Microsoft Defender for Endpoint Module Deployment](https://docs.contraforce.com/guides/onboarding/defender-for-endpoint-module-deployment.md): Deploy the Microsoft Defender for Endpoint module: grant core consents, consent the module and Gamebook response modules, and confirm incidents sync.
- [CrowdStrike Falcon Detection and Response Modules](https://docs.contraforce.com/guides/onboarding/crowdstrike-detection-and-response-modules.md): Create Falcon API clients, connect the CrowdStrike Falcon Detection and Response modules, ingest detections as incidents, and contain hosts with Gamebooks.
- [SentinelOne Detection and Response Modules](https://docs.contraforce.com/guides/onboarding/sentinelone-module.md): Set up the SentinelOne integration for your workspace: create two Service Users, ingest threats as incidents, and run Contain and On-Demand Scan Gamebooks.
- [Sumo Logic Detection Module](https://docs.contraforce.com/guides/onboarding/sumo-logic-module.md): Connect Sumo Logic to your workspace with an OAuth client, investigate monitor alerts as incidents, and manage monitors. Cloud SIEM isn't ingested.
- [Workspace Profiles: Standardize Workspace Settings](https://docs.contraforce.com/guides/fleet-management/workspace-profiles.md): Set access, modules, notifications, Gamebook approvers, and agent policy once in a Workspace Profile, then preview and apply it to all attached workspaces.
- [Onboarding Workspaces at Scale with CSV Import](https://docs.contraforce.com/guides/fleet-management/onboarding-workspaces-at-scale.md): Bulk import up to 200 customer workspaces from a CSV file, track each row's result, and pick a Workspace Profile so new workspaces land already configured.
- [Enterprise Application Permissions and App IDs](https://docs.contraforce.com/guides/technical/enterprise-applications.md): Find each ContraForce enterprise application's app ID, Entra ID permissions, and admin consent needs, plus the Gamebook actions the response apps enable.
- [Azure Resources Deployed for Sentinel and Agents](https://docs.contraforce.com/guides/technical/azure-resources-deployed.md): See which Azure resources ContraForce deploys for your module, from Azure Lighthouse and rg-contraforce-apollo to Agent Center, and how to verify them.
- [Auditing Enterprise App Permissions](https://docs.contraforce.com/guides/technical/auditing-enterprise-app-permissions.md): Audit the permissions granted to ContraForce enterprise apps in Microsoft Entra ID with read-only PowerShell or Python scripts, including GCC High and DoD.
- [Entity Insights](https://docs.contraforce.com/entity-insights.md): Enrich your investigations with sign-in and audit logs, device timelines, threat intelligence, and related incidents for users, devices, IPs, and files.
- [Defender for Endpoint Permissions and Consent](https://docs.contraforce.com/defender-for-endpoint-module.md): Review the permissions and licenses the Defender for Endpoint enterprise application needs, then grant, verify, or revoke consent for your workspace.
- [Defender for Endpoint Capability Matrix by License](https://docs.contraforce.com/guides/technical/microsoft-defender-capability-matrix.md): Check which ContraForce features you get with Defender for Endpoint on Business Premium, E3, or E5, and which need Plan 2, Entra ID, Sentinel, or Exchange.
- [Defender AIR, ZAP, and Attack Disruption](https://docs.contraforce.com/guides/technical/microsoft-defender-native-automations.md): See what Defender AIR, ZAP, and attack disruption handle, how ContraForce shows their status per workspace, and how Security Delivery Agents defer to them.
- [Sentinel and Defender XDR Incident Deduplication](https://docs.contraforce.com/guides/technical/parallel-incident-deduplication.md): See how ContraForce keeps duplicate Microsoft Sentinel and Defender XDR incidents out of your queue, notifications, agent runs, webhooks, and metrics.
- [How the CrowdStrike Falcon Integration Works](https://docs.contraforce.com/guides/technical/crowdstrike-falcon-integration.md): See how CrowdStrike Falcon detections become ContraForce incidents, what the EDR, XDR, and NG-SIEM tiers unlock, and how Falcon retention limits your data.
- [Incident Classification Mapping Across Vendors](https://docs.contraforce.com/concepts/incident-classification.md): See how your incident classification and reason map to Microsoft Sentinel, Defender XDR, and SentinelOne, and how closing a CrowdStrike incident works.
- [Configure Incident Webhooks](https://docs.contraforce.com/guides/technical/configure-webhooks.md): Send signed incident webhooks from ContraForce to your ticketing system, SIEM, or chat tools. Pick events and workspaces, then test and manage deliveries.
- [Setting Up SCIM Provisioning](https://docs.contraforce.com/guides/technical/scim-provisioning.md): Set up SCIM provisioning from Microsoft Entra ID so the people and groups you assign sync to ContraForce, then grant roles and workspace access by group.
- [Agent Shifts: Schedule AI Agent Working Hours](https://docs.contraforce.com/guides/agent-center/agent-shifts.md): Schedule when a Security Delivery Agent investigates on its own by painting working hours on a weekly grid. Off shift, new incidents wait for your team.
- [Agent Execution History](https://docs.contraforce.com/guides/agent-center/agent-execution-history.md): Audit every run of your Security Delivery Agents, troubleshoot failures, and track AI token usage per run in each agent's Execution History tab.
- [On Queue Agents for Defender for Endpoint](https://docs.contraforce.com/guides/agent-center/defender-for-endpoint-on-queue.md): Your On Queue Security Delivery Agents pick up new Defender for Endpoint incidents within about 2 minutes, with no Microsoft Sentinel forwarding required.
- [Operating Procedures for Security Delivery Agents](https://docs.contraforce.com/guides/agent-center/operating-procedures.md): Upload Classification and Response operating procedures or start from templates, then link them to Security Delivery Agents so they follow your policies.
- [Agent Investigation Completed Webhook](https://docs.contraforce.com/guides/agent-center/agent-investigation-webhook.md): Verify and parse the agent.investigation.completed.v1 webhook, then route a Security Delivery Agent's verdict to your SIEM, ticketing, or on-call tools.
- [Content Management Center for Detection Rules](https://docs.contraforce.com/guides/content-management-center/overview.md): Version Microsoft Sentinel and Defender XDR detection rules in the Content Management Center, deploy them to the workspaces you choose, and catch drift.
- [Detection Rule Repositories](https://docs.contraforce.com/guides/content-management-center/repositories.md): Create a detection rule repository, choose the workspaces it covers, set baseline protection and required approvals, and review its audit log.
- [Import, Version, and Deploy Detection Rules](https://docs.contraforce.com/guides/content-management-center/rules.md): Import or author Sentinel and Defender XDR detection rules, deploy them to covered workspaces, track every version, and roll back a bad change.
- [Detection Rule Drift and Workspace Coverage](https://docs.contraforce.com/guides/content-management-center/workspace-coverage.md): Scan your workspaces for detection rule drift, see which rules are in sync, outdated, or not deployed, and resolve edits made outside ContraForce.
- [Detection Rule Change Requests and Approvals](https://docs.contraforce.com/guides/content-management-center/change-requests.md): Review, approve, and merge detection rule change requests in a protected repository, with field-level diffs, required approvals, and audit evidence.
- [Detection Rule Template Marketplace](https://docs.contraforce.com/guides/content-management-center/marketplace.md): Browse ContraForce-maintained detection rule templates by data source, preview a template, pull it into your repository, and tune it before you deploy.
- [Microsoft Sentinel and Defender XDR Rule Platforms](https://docs.contraforce.com/guides/content-management-center/platforms.md): Import, test, and deploy Sentinel analytics rules and Defender XDR custom detections in the Content Management Center, and see which platform a rule needs.
- [Submit a Support Ticket](https://docs.contraforce.com/submit-ticket.md): Open a ContraForce support ticket, choose a category and priority, include the details we need, and track your organization's requests in the Help Center.
- [Workspace Onboarding Verification Checklist](https://docs.contraforce.com/guides/onboarding/workspace-onboarding-checklist.md): Verify a newly onboarded customer workspace before go-live: check module connections, incident sync, Gamebook actions, and Microsoft Sentinel setup.
- [User Roles & Permissions](https://docs.contraforce.com/guides/general-support/roles-and-permissions-reference.md): See the permissions of every ContraForce organization role and workspace role, who can grant roles and API keys, and who can run or approve Gamebooks.
- [User Management: Add Users and Groups](https://docs.contraforce.com/guides/general-support/user-group-management.md): Add users from Microsoft Entra ID, organize them into groups, assign workspace roles in each workspace's IAM tab, and change or remove a user's access.
- [Service Accounts and API Keys](https://docs.contraforce.com/guides/general-support/service-accounts.md): Create service accounts for the ContraForce v2 API, authenticate with a client ID and secret, scope each credential, and rotate secrets with zero downtime.
- [Cost Management Center](https://docs.contraforce.com/guides/general-support/cost-management-center.md): Use the Cost Management Center to see your plan, XDR and XDR + SIEM licenses, agent token usage, and billing, then set usage budgets and spend controls.
- [Offboarding: Remove ContraForce Apps and Resources](https://docs.contraforce.com/guides/general-support/offboarding-contra-force.md): Offboard ContraForce by removing its enterprise apps from Microsoft Entra ID, Azure resources, role assignments, and any Azure Lighthouse delegation.
- [Shared Teams Channel with the Success Team](https://docs.contraforce.com/guides/general-support/contraforce-success-teams-channel.md): Set up a shared Teams channel with the ContraForce Success Team by allowing outbound B2B direct connect in Microsoft Entra cross-tenant access settings.
- [Meeting Cyber Insurance Requirements](https://docs.contraforce.com/guides/contraforce-and-compliance/contraforce-and-cyber-insurance.md): See how ContraForce maps to cyber insurance requirements like 24/7 monitoring, EDR, SIEM, and incident response, and how to answer application questions.
- [REST API v2 Endpoint Reference](https://docs.contraforce.com/api-reference/endpoints.md): Browse ContraForce v2 REST API endpoints by scope, with the base URL, HTTP Basic auth, cross-workspace pagination, and how to sync incident updates.
- [API Object Models and JSON Examples](https://docs.contraforce.com/api-reference/models.md): Copy JSON request and response examples for the ContraForce v2 API: envelopes, incidents, comments, webhooks, delivery logs, service accounts, and users.
- [Webhook Event Reference](https://docs.contraforce.com/api-reference/webhook-events.md): Look up every webhook event ContraForce sends, such as incident.created.v1, with payload schemas, HMAC-SHA256 signature verification, and retry rules.
- [API Error Code Reference](https://docs.contraforce.com/api-reference/errors.md): Look up any ContraForce v2 API error code, such as INSUFFICIENT_SCOPE or UPSTREAM_ERROR, with its HTTP status and what to do, plus the RFC 7807 shape.
- [Get incident by id](https://docs.contraforce.com/api-reference/incidents/get-incident-by-id.md)
- [Get incident evidence](https://docs.contraforce.com/api-reference/incidents/get-incident-evidence.md)
- [Get incident last gamebook](https://docs.contraforce.com/api-reference/incidents/get-incident-last-gamebook.md)
- [Get incidents by entity](https://docs.contraforce.com/api-reference/incidents/get-incidents-by-entity.md)
- [Update incident status](https://docs.contraforce.com/api-reference/incidents/update-incident-status.md)
- [Assign incident](https://docs.contraforce.com/api-reference/incidents/assign-incident.md)
- [Get incident comments](https://docs.contraforce.com/api-reference/incidents/get-incident-comments.md)
- [Create incident comment](https://docs.contraforce.com/api-reference/incidents/create-incident-comment.md)
- [Update incident comment](https://docs.contraforce.com/api-reference/incidents/update-incident-comment.md)
- [Delete incident comment](https://docs.contraforce.com/api-reference/incidents/delete-incident-comment.md)
- [Ingest incident](https://docs.contraforce.com/api-reference/incidents/ingest-incident.md)
- [Get playbooks by incident title](https://docs.contraforce.com/api-reference/gamebooks/get-playbooks-by-incident-title.md)
- [List gamebooks history](https://docs.contraforce.com/api-reference/gamebooks/list-gamebooks-history.md)
- [Get playbooks by gamebook id](https://docs.contraforce.com/api-reference/gamebooks/get-playbooks-by-gamebook-id.md)
- [List incident gamebooks](https://docs.contraforce.com/api-reference/gamebooks/list-incident-gamebooks.md)
- [Run a gamebook](https://docs.contraforce.com/api-reference/gamebooks/run-a-gamebook.md): Requires gamebooks:execute and access to the route workspace. Service accounts may submit new gamebooks only: only documented inputs are accepted; portal approval, retry, and internal state fields are rejected. Playbook sequence values must contain exactly 1..N without duplicates or gaps. Workspace…
- [Get connected datasources](https://docs.contraforce.com/api-reference/data-sources/get-connected-datasources.md)
- [Search tickets](https://docs.contraforce.com/api-reference/service-tickets/search-tickets.md)
- [Link ticket](https://docs.contraforce.com/api-reference/service-tickets/link-ticket.md)
- [Unlink ticket](https://docs.contraforce.com/api-reference/service-tickets/unlink-ticket.md)
- [Update ticket priority](https://docs.contraforce.com/api-reference/service-tickets/update-ticket-priority.md)
- [List signin logs](https://docs.contraforce.com/api-reference/investigation/list-signin-logs.md)
- [List directory logs](https://docs.contraforce.com/api-reference/investigation/list-directory-logs.md)
- [Export audit events](https://docs.contraforce.com/api-reference/export/export-audit-events.md)
- [Agent tool submit gamebook](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-submit-gamebook.md)
- [Agent tool submit investigation](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-submit-investigation.md)
- [Agent tool get user details](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-get-user-details.md)
- [Agent tool list kql tables](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-list-kql-tables.md)
- [Agent tool get kql table columns](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-get-kql-table-columns.md)
- [Agent tool execute kql](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-execute-kql.md)
- [Agent tool list signin logs](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-list-signin-logs.md)
- [Agent tool list directory logs](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-list-directory-logs.md)
- [Agent tool get device timeline](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-get-device-timeline.md)
- [Agent tool related incidents](https://docs.contraforce.com/api-reference/agent-tools/agent-tool-related-incidents.md)
- [List incidents across workspaces](https://docs.contraforce.com/api-reference/cross-workspace-incidents/list-incidents-across-workspaces.md)
- [Bulk update incidents across workspaces](https://docs.contraforce.com/api-reference/cross-workspace-incidents/bulk-update-incidents-across-workspaces.md)
- [List gamebooks history across workspaces](https://docs.contraforce.com/api-reference/cross-workspace-gamebooks/list-gamebooks-history-across-workspaces.md)
- [List datasource anomalies across workspaces](https://docs.contraforce.com/api-reference/cross-workspace-data-sources/list-datasource-anomalies-across-workspaces.md)
- [Get datasource workspaces across workspaces](https://docs.contraforce.com/api-reference/cross-workspace-data-sources/get-datasource-workspaces-across-workspaces.md)
- [List webhooks](https://docs.contraforce.com/api-reference/webhooks/list-webhooks.md)
- [Create webhook](https://docs.contraforce.com/api-reference/webhooks/create-webhook.md)
- [Get webhook](https://docs.contraforce.com/api-reference/webhooks/get-webhook.md)
- [Update webhook](https://docs.contraforce.com/api-reference/webhooks/update-webhook.md)
- [Delete webhook](https://docs.contraforce.com/api-reference/webhooks/delete-webhook.md)
- [List webhook delivery logs](https://docs.contraforce.com/api-reference/webhooks/list-webhook-delivery-logs.md)
- [Get webhook delivery log](https://docs.contraforce.com/api-reference/webhooks/get-webhook-delivery-log.md)
- [Pause webhook](https://docs.contraforce.com/api-reference/webhooks/pause-webhook.md)
- [Resume webhook](https://docs.contraforce.com/api-reference/webhooks/resume-webhook.md)
- [Enable webhook](https://docs.contraforce.com/api-reference/webhooks/enable-webhook.md)
- [Update webhook credentials](https://docs.contraforce.com/api-reference/webhooks/update-webhook-credentials.md)
- [Regenerate webhook secret](https://docs.contraforce.com/api-reference/webhooks/regenerate-webhook-secret.md)
- [Test webhook](https://docs.contraforce.com/api-reference/webhooks/test-webhook.md)
- [Redeliver webhook](https://docs.contraforce.com/api-reference/webhooks/redeliver-webhook.md)
- [List service accounts](https://docs.contraforce.com/api-reference/service-accounts/list-service-accounts.md)
- [Create service account](https://docs.contraforce.com/api-reference/service-accounts/create-service-account.md)
- [Get service account](https://docs.contraforce.com/api-reference/service-accounts/get-service-account.md)
- [Update service account](https://docs.contraforce.com/api-reference/service-accounts/update-service-account.md)
- [Delete service account](https://docs.contraforce.com/api-reference/service-accounts/delete-service-account.md)
- [Disable service account](https://docs.contraforce.com/api-reference/service-accounts/disable-service-account.md)
- [Enable service account](https://docs.contraforce.com/api-reference/service-accounts/enable-service-account.md)
- [Create service account credential](https://docs.contraforce.com/api-reference/service-accounts/create-service-account-credential.md)
- [Revoke service account credential](https://docs.contraforce.com/api-reference/service-accounts/revoke-service-account-credential.md)
- [Provision sentinel ingest credential](https://docs.contraforce.com/api-reference/service-accounts/provision-sentinel-ingest-credential.md)
- [List users](https://docs.contraforce.com/api-reference/users/list-users.md)
- [Update user](https://docs.contraforce.com/api-reference/users/update-user.md)
- [Add user](https://docs.contraforce.com/api-reference/users/add-user.md)
- [Get user](https://docs.contraforce.com/api-reference/users/get-user.md)
- [Get user profile](https://docs.contraforce.com/api-reference/users/get-user-profile.md)
- [Update user profile](https://docs.contraforce.com/api-reference/users/update-user-profile.md)
- [Get workspace users](https://docs.contraforce.com/api-reference/users/get-workspace-users.md)
- [Remove user](https://docs.contraforce.com/api-reference/users/remove-user.md)
- [Add workspace users](https://docs.contraforce.com/api-reference/users/add-workspace-users.md)
- [Update org role](https://docs.contraforce.com/api-reference/users/update-org-role.md)
- [List azure subscriptions](https://docs.contraforce.com/api-reference/azure-resources/list-azure-subscriptions.md)
- [List azure nsgs](https://docs.contraforce.com/api-reference/azure-resources/list-azure-nsgs.md)
- [Check azure subscription owner](https://docs.contraforce.com/api-reference/azure-resources/check-azure-subscription-owner.md)
- [List azure resource groups](https://docs.contraforce.com/api-reference/azure-resources/list-azure-resource-groups.md)
- [List azure workspaces](https://docs.contraforce.com/api-reference/azure-resources/list-azure-workspaces.md)
- [List azure sentinels](https://docs.contraforce.com/api-reference/azure-resources/list-azure-sentinels.md)
- [Validate azure workspace](https://docs.contraforce.com/api-reference/azure-resources/validate-azure-workspace.md)
- [Update analytical rule](https://docs.contraforce.com/api-reference/azure-resources/update-analytical-rule.md)
- [Release Notes](https://docs.contraforce.com/release-notes.md): Read the ContraForce release notes: new features, improvements, and fixes for incidents, Gamebooks, agents, workspaces, and the API, newest first.
- [Blog: Agentic AI, Managed Security, and Product News](https://docs.contraforce.com/blog/index.md): Read the ContraForce blog for product announcements, agentic AI thought leadership, MSP and MSSP outcome stories, and company awards and partnerships.
- [Operating Procedures Now Power Your Security Delivery Agents](https://docs.contraforce.com/blog/product-announcements/sop-knowledge-base.md): Upload Classification and Response operating procedures, map them to MITRE ATT&CK, and link them to Security Delivery Agents to guide incident response.
- [Launching the Security Delivery Platform for AI-Driven MXDR](https://docs.contraforce.com/blog/product-announcements/security-delivery-platform-launch.md): Microsoft-focused MSPs and MSSPs can deliver AI-driven MXDR with Security Delivery Agents: 60x faster investigations and 93% lower cost per incident.
- [Security Delivery Agents: AI Incident Response at Scale](https://docs.contraforce.com/blog/product-announcements/security-delivery-agents.md): Now generally available: AI agents that investigate incidents and run Gamebooks within confidence thresholds you set. Start manual, then add automation.
- [Easier Sentinel and Defender for Endpoint Investigations](https://docs.contraforce.com/blog/product-announcements/incident-investigation-improvements.md): Investigate Microsoft Sentinel and Defender for Endpoint incidents in the Workbench with entity enrichment, then respond without leaving the incident.
- [Splunk, CrowdStrike Falcon, and IBM QRadar Support Added](https://docs.contraforce.com/blog/product-announcements/siem-xdr-platform-support.md): In July 2024, ContraForce added Splunk ES, CrowdStrike Falcon XDR, and IBM QRadar SIEM support, extending Gamebook workflows across SIEM and XDR platforms.
- [A Better Way to Manage Microsoft Sentinel Detection Content](https://docs.contraforce.com/blog/product-announcements/detection-content-management.md): Deploy and roll back detection rules across customer Microsoft Sentinel workspaces in bulk, a capability that now lives in the Content Management Center.
- [Gamebook Automation and Mapping for Faster Incident Response](https://docs.contraforce.com/blog/product-announcements/gamebook-automation-mapping.md): Incidents map to the right Gamebook automatically by type and severity. Choose how much of the response is automated and see every action before it runs.
- [More Hosting Regions for EU, UK, and APAC Data Residency](https://docs.contraforce.com/blog/product-announcements/global-hosting-regions.md): Hosting expands beyond the US to Europe, the UK, and Asia-Pacific, so you can meet customer data residency needs. Ask your account team about availability.
- [Datto Autotask PSA Integration Improves Case Management](https://docs.contraforce.com/blog/product-announcements/autotask-psa-integration.md): Connect Datto Autotask PSA to ContraForce to create Autotask tickets for security incidents and track your security case work in the PSA you already use.
- [Scaling Security Delivery Without Scaling Headcount](https://docs.contraforce.com/blog/outcomes-value/scale-security-delivery.md): See how MSPs and MSSPs use Security Delivery Agents, Gamebooks, and the Command Dashboard to cover more customers without a matching rise in headcount.
- [5 Ways MSPs Can Help Customers Lower Cyber Insurance Costs](https://docs.contraforce.com/blog/outcomes-value/msp-cyber-insurance-costs.md): See 5 ways MSPs using ContraForce can help customers lower cyber insurance costs, from faster threat response to incident documentation and SOC services.
- [Agentic AI in Security Operations: Agents vs. Copilots](https://docs.contraforce.com/blog/agentic-ai/what-are-security-delivery-agents.md): See how agentic AI in security operations differs from copilots, and how Security Delivery Agents investigate and respond with progressive autonomy.
- [10 Ways to Automate Multi-Tenant Microsoft Sentinel](https://docs.contraforce.com/blog/agentic-ai/10-ways-multi-tenant-automation.md): See 10 ways to automate multi-tenant Microsoft Sentinel and Defender for Endpoint management: one incident queue, Gamebooks, and response in any workspace.
- [Security Delivery Platforms: Reimagining the MSSP Model](https://docs.contraforce.com/blog/agentic-ai/security-delivery-platform-reimagining.md): See how a Security Delivery Platform reimagines the MSSP model, replacing per-customer portals and headcount-driven growth with multi-tenant automation.
- [How MSSPs Can Implement CISA SIEM and SOAR Guidance](https://docs.contraforce.com/blog/agentic-ai/cisa-siem-soar-guidance.md): See how MSSPs can apply CISA SIEM and SOAR guidance on log collection, automated response, and threat intelligence, with a phased implementation roadmap.
- [SIEM Market Consolidation: What It Means for MDR Providers](https://docs.contraforce.com/blog/agentic-ai/siem-vendor-landscape.md): See how SIEM market consolidation and XDR convergence affect MDR providers, from choosing platforms to protecting margins and staying platform-agnostic.
- [How to Become an MSSP: 7 Essential Features](https://docs.contraforce.com/blog/agentic-ai/mssp-essential-features.md): Moving from MSP to MSSP? See the 7 capabilities you need, from multi-tenant visibility and incident triage to response automation, reporting, and scale.
- [Named a Microsoft Security Excellence Awards Finalist](https://docs.contraforce.com/blog/company/microsoft-security-excellence-finalist.md): ContraForce was named a Microsoft Security Excellence Awards finalist for Security Software Development Company, chosen from hundreds of submissions.
- [Named 2025 Security Orchestration Solution of the Year](https://docs.contraforce.com/blog/company/cybersecurity-breakthrough-awards-2025.md): ContraForce was named Security Orchestration Solution of the Year in the 2025 CyberSecurity Breakthrough Awards, which drew thousands of nominations.
- [Honored as a 2024 SC Awards Winner](https://docs.contraforce.com/blog/company/sc-awards-winner-2024.md): ContraForce was named a 2024 SC Awards winner. Its platform stood out for its approach to multi-tenant security operations and AI-driven automation.
- [Selected for the Microsoft for Startups Pegasus Program](https://docs.contraforce.com/blog/company/microsoft-pegasus-program.md): ContraForce was selected for the Microsoft for Startups Pegasus Program, gaining deeper Microsoft integration and closer work with Microsoft product teams.
- [Completes Fourth Consecutive SOC 2 Type II Audit](https://docs.contraforce.com/blog/company/soc-2-type-ii-fourth-time.md): ContraForce completed its fourth consecutive SOC 2 Type II audit, and its SOC 3 summary report is available for partners' compliance documentation.
- [US Distribution Agreement with Ingram Micro](https://docs.contraforce.com/blog/company/ingram-micro-distribution.md): A US distribution agreement lets US-based MSPs access ContraForce through Ingram Micro to operationalize Microsoft Sentinel and Defender for Endpoint.
- [Complete Cyber Insurance Buying Guide: Coverage to Claims](https://docs.contraforce.com/blog/complete-cyber-insurance-buying-guide.md): Before you buy cyber insurance, see what it covers and excludes, how premiums are set, how to compare quotes, and how to file a claim to maximize recovery.
- [How to Build a Cybersecurity Budget and Justify ROI](https://docs.contraforce.com/blog/how-to-build-a-cybersecurity-budget.md): Build your cybersecurity budget step by step: assess risk, benchmark spend, set categories, calculate ROI with the ALE model, and present it to the board.
- [After the Breach: Data Breach Recovery and Communication](https://docs.contraforce.com/blog/after-the-breach.md): Use this data breach recovery plan to confirm containment, map notification deadlines, communicate with stakeholders, and run a post-incident review.
- [How to Build a Cybersecurity Stack for Small Businesses](https://docs.contraforce.com/blog/how-to-build-your-cybersecurity-stack.md): Plan a cybersecurity stack for your small or mid-sized business: the tools you need, how to vet vendors, what to ask in demos, and what to build first.

## OpenAPI Specs

- [openapi](/api-reference/openapi.json)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.