Feature Modules

The modules together provide platform-level security operations capabilities: session management is the main interaction entry point; Task Center handles scheduling and continuous execution; Workspace manages project boundaries and artifacts; Agent defines execution roles; Skills capture reusable experience; Workflow defines stable processes; device management connects security devices and data sources; the tool inventory defines executable actions; the plugin hub discovers and installs local plugins and scenario suites; Model List manages underlying model resources; channel management handles external message delivery; and accounts, audit logs, and Flocks Pro provide enterprise governance.

In the WebUI main navigation, these modules are grouped as follows:

• AI Workbench: Session Management · Task Center · Workspace
• Agent Studio: Agent · Skills · Workflow · Device Management · Tool Inventory · Flocks Hub · Model List · Channel Management
• System Center: Account Management · Audit Logs · Flocks Pro · Flocks CLI · Flocks Slash Commands

1. Capability Selection Principles

Skill, Agent / Subagent, and Workflow can all carry task-specific capabilities. The key differences are how fixed the process is, how flexible execution needs to be, and how the main Agent participates.

• Workflow
  • Purpose: Capture task steps, tool calls, and decision logic as a stable process. A Workflow can become an auditable and reproducible automation playbook, or a process service that exposes a stable external invocation entry point.
  • Characteristics: Supports structured JSON input published as an API, and also supports streaming inputs such as syslog and Kafka published as streaming tasks. The process is fixed and the output is stable, making it suitable for standardized execution and continuous operations.
  • Use cases: High-frequency, repetitive, well-defined tasks that require consistency, and scenarios that need a standardized service interface or continuous processing of real-time streams, such as alert triage, asset checks, batch IOC lookup, report generation, security device log processing, alert stream consumption, and asset-change event handling.
• Agent / Subagent
  • Purpose: Within a preset System Prompt and fixed tool set, autonomously understand the goal, plan the path, and complete the task.
  • Characteristics: More flexible than Workflow, while still constrained by the role definition, context window, and tool boundaries.
  • Use cases: Analysis, retrieval, troubleshooting, and response tasks with clear goals but paths that must adapt dynamically to context.
• Skill
  • Purpose: A capability package loaded by the main Agent as needed, providing methodology, operating rules, domain context, and reusable experience.
  • Characteristics: The most flexible option. The main Agent can load multiple Skills at once and combine them to complete cross-domain, complex, or long-chain tasks.
  • Use cases: Tasks that require unified orchestration by the main Agent, coordination across multiple capabilities, or continuous capture and reuse of experience.

Choose based on the nature of the task. Prefer Workflow for tasks that must be stable, controllable, and repeatable; prefer Agent / Subagent or Skill for tasks that require intelligent judgment, contextual adaptation, and dynamic decisions; build Skills first when tasks need cross-domain composition, long-term evolution, and unified scheduling by the main Agent.

Keep composition restrained. In general, avoid mixing Workflow, Agent / Subagent, and Skill for a single task. Unless the task has clear layered boundaries and real orchestration value, combining too many mechanisms too early increases the cost of understanding, debugging, and maintenance, and often becomes unnecessary overdesign.

2. Core Modules

2.1 Session Management

Session management is the main interaction entry point in Flocks and the starting point for most tasks. Users describe goals to the main Agent Rex in natural language. Rex combines the current session context, Workspace project context, available tools, Workflow, Skills, and expert Agents to decide whether to answer directly, call a tool, delegate to a sub-agent, or generate a new reusable capability.

Typical uses: create a session for Rex to assess an alert · continue asking follow-up questions and adding clues in the same session · turn a successful response into an Agent / Workflow / Skill

---

2.2 Task Center

Scheduling and operations capability. It turns one-off actions into ongoing operations: periodic inspections, batch alert cleanup, daily and weekly report generation, and automated handling for fixed alert types. It supports both Agent-based and Workflow-based execution modes.

Typical uses: pull TDP alerts every hour for case-by-case triage · track ticket progress daily · notify on key asset changes

---

2.3 Workspace

A project-level organizational boundary. It stores plugins, workflows, skills, configuration, task outputs, and project context. Test data generated by workflows, Agent inspection reports, and structured JSON usually go into the Workspace outputs/ directory.

Typical uses: isolate capabilities by customer or project · archive outputs · reference the same artifacts across sessions

---

2.4 Agent

The main Agent Rex is the unified entry point. It interprets intent, breaks down tasks, and schedules capabilities. Expert Agents focus on specific problem domains such as intelligence analysis, host inspection, vulnerability analysis, and web data extraction. Flocks supports creating a sub-agent from a concise natural-language description; Rex selects an appropriate tool set, writes the Prompt, and runs the ReAct loop.

Typical uses: create a Security Inspection sub-agent to inspect TDP / OneSEC · package a mature investigation routine as a scheduled Agent task

---

2.5 Skills

Skills carry experience, rules, methodologies, and task templates. You can think of them as the "experience layer" in the platform that can be loaded and reused. Flocks supports installing Skills from GitHub, URLs, local paths, and clawhub, and also supports creating a new Skill with a single natural-language request.

Typical uses: malicious Skill security audit · alert triage methodology · API tool generator / workflow generator

---

2.6 Workflow

Workflow organizes actions into stable playbooks. Flocks Workflow supports natural-language generation and then runs automatic validation, single-node tests, and integration tests, making it suitable for capturing standardized security operations processes.

Typical uses: NDR alert triage workflow · phishing email response playbook · standard response for fixed alert types

---

2.7 Device Management

Device management corresponds to the Data Sources and Devices page in the WebUI. It manages access to security devices and data sources in one place, and maintains three dimensions for each instance: API, web2cli, and device Skill.

Typical uses: connect NDR / firewall / HIDS / SIEM · maintain device API capabilities · turn Web console actions into web2cli · bind device inspection Workflow

---

2.8 Tool Inventory

Executable capabilities that the platform can call directly include built-in tools, API tools, local tools, and MCP services. MCP is now integrated into the tool inventory page and is no longer a separate top-level menu. After a user provides API documentation or an MCP address, Rex can help generate tools and validate and debug them.

Typical uses: quickly connect VT / ThreatBook / GreyNoise · wrap internal enterprise APIs consistently · connect external MCP services

---

2.9 Flocks Hub

Flocks Hub is Flocks' local plugin hub. It is used to discover, filter, preview, install, and uninstall Skill, Agent, Tool, Workflow, WebUI plugins, and scenario suites shipped locally with a release. It is not a cloud plugin marketplace. Installed plugins enter their corresponding modules and refresh runtime capabilities.

Typical uses: install an alert triage Skill · install an expert Agent · review Tool plugin permissions and risks · install a bundled Workflow locally · install a SOC workspace scenario suite

---

2.10 Model List

The model resource governance entry point: manage Providers, model instances, default models, and model test results. Initial Flocks setup must go through this module first. For the configuration order, see Model Configuration; for local or third-party model access, see Local and Third-Party Model Integration; for model error troubleshooting, see Model Error Troubleshooting.

Typical uses: first default model configuration · assign different models by task · connect local / third-party OpenAI-compatible models

---

2.11 Channel Management

Channel management configures external channels such as Feishu, WeCom, Slack, DingTalk, Telegram, Weixin, WhatsApp, and email integrations. It lets Rex receive messages from team collaboration entry points, and lets Task Center and Workflow push results to specified groups, users, or mailboxes.

Typical uses: @Rex in a group to trigger triage · send scheduled inspection results to WeCom · push alert triage reports to Feishu

---

2.12 Account Management

Account management manages local login accounts for the WebUI. The open-source OSS edition has only one admin account. Flocks Pro supports multiple accounts, role management, quota control, and audit of account operations.

Typical uses: initialize the admin account · change a password · create a member user in Pro · reset a temporary password

---

2.13 Audit Logs

Audit logs are a Flocks Pro feature for querying account, authorization, and key system operation records. They support filtering by event type, user, result, and time range, and can be exported to Excel.

Typical uses: trace who created an account · review a License activation · export administrator operation records

---

2.14 Flocks Pro

Flocks Pro is the Pro upgrade and license management entry point. It is used for cloud account login, upgrade application submission, approval status tracking, Pro bundle installation, License viewing, and authorization synchronization. After it is enabled, enterprise capabilities such as multiple accounts, audit logs, and license quota management become available.

Typical uses: apply for a 30-day trial · install Pro components · view License expiration time and quotas

---

2.15 Flocks CLI

A consolidated reference for Flocks terminal CLI commands. It is useful for quickly checking local operations commands for service start and stop, logs, tasks, MCP, Skill, account maintenance, and session import and export.

Typical uses: query flocks task usage · start flocks tui / flocks run · find the administrator password recovery command

---

2.16 Flocks Slash Commands

A consolidated reference for / commands available in WebUI, TUI, CLI sessions, and IM channels. It is useful for viewing tools, Skills, Agents, Workflow, MCP, task queues, and IM session state from the current session.

Typical uses: view /tools info · use /new to restart a session · use /status to view the Session bound to an IM conversation

3. How Modules Work Together

If you are learning Flocks for the first time, use this main path to understand how the modules relate to each other:

1. Complete default model configuration in Model List
2. Give Rex a goal in WebUI Session Management
3. Let Rex call Tools, load Skills, delegate to Agent, connect Devices, or generate Workflow as needed
4. Turn one-off work into scheduled operations in Task Center
5. Install new Skill, Agent, Tool, or Workflow plugins from Flocks Hub
6. Use Channel Management to send results to collaboration entry points
7. Capture experience and project assets in Skills and Workspace
8. In Pro scenarios, use Account Management, Audit Logs, and Flocks Pro to manage enterprise governance capabilities

After you understand this chain, it is easier to distinguish the responsibilities of each functional entry point and combine platform capabilities around business scenarios.

---

Related Resources: Project Overview · Quick Start · Model Configuration · Deployment and Configuration · Scenario Practices · Operations and Troubleshooting