FlocksAgent-Powered Security Operations

Build repeatable workflows and closed-loop operations from everyday security work

Multi-agent Collaboration

Rex handles intent recognition, goal decomposition, and execution coordination, while specialist Agents focus on intelligence, host, vulnerability, and web-data tasks.

Agents

🔁

Workflow Orchestration

Workflows turn scattered actions into stable, testable playbooks. Task Center supports scheduled runs, batch processing, and continuous operations.

Workflows

🧰

Tools and MCP

A unified tool system covers built-in tools, API tools, Python tools, and MCP services, bringing ThreatBook, VT, FOFA, and internal platforms into one execution context.

Tools

📚

Skills and Knowledge Reuse

Skills capture procedures, policies, methodologies, and task templates so individual experience becomes shared operational knowledge.

Skills

🔌

Security Device Integration

Connect security devices, APIs, web consoles, and intranet systems so external capabilities can be used directly by Flocks.

Devices

🛡️

Security Scenarios

Reusable practices for alert triage, host inspection, device integration, threat intelligence, vulnerability validation, and other SOC workflows.

Scenarios

Who should read this documentation

Security operations teams that need multi-source correlation and initial alert triage
Platform operations teams that want to turn investigation steps into Workflows, Skills, or specialist Agents
Integration teams that need to connect security devices, APIs, web consoles, or intranet systems
Architecture and governance teams that want to turn one-time analysis into continuously running capability

Find What You Need

Getting Started

Start with Overview to understand what Flocks is for.
Follow Quick Start to install the minimum environment.
Complete First-Time Setup for accounts and model configuration.
Start with one core scenario: Alert Triage or Threat Intelligence.

Deployment and Setup

Follow Deployment and Configuration in order.
Configure models and providers with Model Configuration and Model Troubleshooting.
Configure message channels: DingTalk, Feishu, WeCom, Slack, Telegram, WeChat, WhatsApp, or Email Integration.
Connect internal tools from Tools.

Building SOC Scenarios

Understand the product architecture in Modules: Agents, Workflows, and Task Center.
Jump to a scenario such as Alert Triage, Host Inspection, or Vulnerability Validation.
Turn repeatable work into ongoing scheduled operations with Tasks and Operations.
Use the troubleshooting pages when blocked: Installation Troubleshooting and Upgrade Troubleshooting.