Run the work. Not just the incidents.
Reviewed by ContraForce team · Updated 2026-10-02
Most AI stops at the investigation. ContraForce runs to the report.
MDR outsources the work. AI-SOC tools stop at the investigation verdict. ContraForce Security Delivery Agents run the whole loop and close it, so the ticket is updated, the report is ready, and your analysts review outcomes instead of writing them up.
Autonomy is earned, not assumed.
No team hands an agent the keys on day one, and ContraForce does not ask you to. Start in review mode: Security Delivery Agents investigate and recommend, your analysts approve every action. Watch the agents follow your Gamebooks on your real incidents.
When the verdicts hold up, expand autonomy one Gamebook at a time. Approval gates, guardrails, and a full audit trail stay in place at every level. AI that acts. Humans who decide.
Does ContraForce require Microsoft Sentinel?
ContraForce does not require Microsoft Sentinel. Sentinel not required. ContraForce runs full delivery on Defender XDR alone. Add Sentinel when and where a customer needs it. Security Delivery Agents also work against telemetry from other tools via API.
How does ContraForce relate to Microsoft Security Copilot?
ContraForce works alongside Microsoft Security Copilot. Copilot helps analysts ask better questions of their security data. ContraForce Security Delivery Agents execute the delivery loop itself: triage, investigation, response, tuning, ticket, report. Many partners run both.
The ContraForce platform runs the full delivery loop on the Microsoft Security platform. Security Delivery Agents handle triage, investigation, evidence gathering, response, ticketing, and customer reporting across every tenant. Gamebooks turn your operating procedures into governed workflows. Every action is logged, attributed, and auditable.
How does ContraForce fit into an existing SOC workflow?
- Connect a workspace. Validate federated access, least privilege, and the configured workflow without duplicating customer logs into a ContraForce-owned SIEM.
- Agents triage every incident. Security Delivery Agents enrich the alert, run investigation steps, and classify the incident against your Gamebook policy.
- Gamebooks enforce your operating procedures. The investigation and response procedure follows your documented standard. Human-in-the-loop gates approve any consequential action.
- Response, ticket, customer report. ContraForce executes approved actions across endpoints, identity, and ticketing systems. The customer-facing summary is generated automatically.
- Audit trail by default. Every decision the agent made, every action it took, and every approval gate is logged with full attribution.
What can the ContraForce platform do?
- Security Delivery Agents for triage, investigation, response, and reporting
- Gamebook Engine and operating procedure enforcement across every tenant
- EDR integrations: Microsoft Defender XDR, SentinelOne, CrowdStrike
- SIEM integration: Microsoft Sentinel
- Ticketing integrations: Autotask, ServiceNow, Jira
- Multi-tenant control plane with federated access
- Zero data custody, operates inside the customer tenant
- SOC 2 Type II certified, MISA member, Microsoft Security ISV of the Year three-time recognition
Who is ContraForce for?
ContraForce is built for MSSPs, MSPs, and security operations teams running Microsoft Sentinel and Defender XDR. Telecom and large enterprise security teams use the same ContraForce platform to manage thousands of tenants from one control plane.
What integrations does ContraForce support?
ContraForce integrates with Microsoft Defender XDR and Microsoft Sentinel, plus SentinelOne and CrowdStrike for XDR. Ticketing integrations include Autotask, ServiceNow, and Jira from the Growth plan upward. REST and webhook APIs are available on every ContraForce Cloud plan for custom workflows.
What is a Security Delivery Agent?
A ContraForce Security Delivery Agent triages incidents, investigates threats, gathers evidence, and carries work through response, tuning, ticketing, and reporting. It follows your Gamebooks and stops at the approval gates you set.
Does ContraForce replace my SIEM?
No. ContraForce works with your existing SIEM and EDR, including Microsoft Defender XDR, Microsoft Sentinel, SentinelOne, and CrowdStrike. Your tools detect threats; ContraForce handles investigation, response, and reporting.
Can I control which actions a ContraForce agent takes?
Yes. ContraForce lets you choose investigation only or investigation and response. Decide whether agents can run Gamebooks, require human approval for sensitive actions, and review the audit trail.
Does ContraForce support VIP lists?
Yes. ContraForce supports VIP lists through Agent Policies. Set rules to block agent investigations involving VIP users so those incidents stay with your analysts for review and response.
Can I set different automation levels per tenant?
Yes. ContraForce lets you configure agents, policies, Gamebook permissions, and approvers per workspace. Match automation to each customer’s requirements, with analysts supervising where needed.
Can ContraForce create a ticket in my PSA from an incident?
Yes. ContraForce lets analysts create or link tickets from an incident, keeping the investigation and evidence attached. Your team can follow the work from the incident to the connected ticketing system.
Does ContraForce store customer security data?
Your logs and telemetry stay in your SIEM or XDR. ContraForce stores the incident records, verdicts, and evidence its agents produce in your assigned regional deployment, without operating a separate security data lake.