| 1 | --- |
| 2 | title: SOCFortress Capsules |
| 3 | description: Operator playbooks that walk you from alert → investigation → response using CoPilot. |
| 4 | --- |
| 5 | |
| 6 | Capsules are short, task-focused operator playbooks based on SOCFortress video walkthroughs. |
| 7 | |
| 8 | Use them when you want a **step-by-step path** from an alert to investigation and response inside CoPilot. |
| 9 | |
| 10 | --- |
| 11 | |
| 12 | ## Quick start: pick a goal |
| 13 | |
| 14 | - **Contain a host from a C2 alert** → [C2 alert to containment](/user/capsules/c2-alert-to-containment) |
| 15 | - **Investigate suspicious persistence** → [Suspicious scheduled tasks](/user/capsules/suspicious-scheduled-tasks) |
| 16 | - **Remove unauthorized privilege** → [Rogue local admin accounts](/user/capsules/rogue-local-admin-accounts) |
| 17 | - **Validate a detection** → [Atomic Red Team validation](/user/capsules/validate-detections-atomic-red-team) |
| 18 | - **Run response actions** → [Endpoint response actions](/user/capsules/endpoint-response-actions-copilot) |
| 19 | - **Memory forensics / malware hunting** → [Volatility 3 malware hunting](/user/capsules/volatility-3-malware-hunting) |
| 20 | |
| 21 | --- |
| 22 | |
| 23 | ## Capsules by category |
| 24 | |
| 25 | <details> |
| 26 | <summary><strong>Incident Response Playbooks</strong></summary> |
| 27 | |
| 28 | - [Step-by-Step IR: From C2 Alert to Full Containment](/user/capsules/c2-alert-to-containment) |
| 29 | - [SOC Playbook: Detecting and Removing Suspicious Scheduled Tasks](/user/capsules/suspicious-scheduled-tasks) |
| 30 | - [Detecting & Removing Rogue Local Admin Accounts](/user/capsules/rogue-local-admin-accounts) |
| 31 | |
| 32 | </details> |
| 33 | |
| 34 | <details> |
| 35 | <summary><strong>CoPilot How-Tos</strong></summary> |
| 36 | |
| 37 | - [Endpoint Response Actions with CoPilot](/user/capsules/endpoint-response-actions-copilot) |
| 38 | - [Validate Detections with Atomic Red Team (CoPilot)](/user/capsules/validate-detections-atomic-red-team) |
| 39 | |
| 40 | </details> |
| 41 | |
| 42 | <details> |
| 43 | <summary><strong>Forensics</strong></summary> |
| 44 | |
| 45 | - [Volatility 3 Malware Hunting (Full Tutorial)](/user/capsules/volatility-3-malware-hunting) |
| 46 | |
| 47 | </details> |
| 48 | |
| 49 | --- |
| 50 | |
| 51 | ## What each capsule includes |
| 52 | |
| 53 | - What you’re trying to accomplish |
| 54 | - When to use it (what kind of alert/context) |
| 55 | - Prerequisites (data sources + access) |
| 56 | - Step-by-step procedure |
| 57 | - Validation (“what good looks like”) |
| 58 | - Safety notes (containment vs evidence preservation) |
| 59 | - Video link |