Session Management

Session Management is the primary interaction entry point in Flocks. Users talk with the main Agent, Rex, describe goals in natural language, add context, inspect execution progress, and turn a successful task into an Agent, Skill, Workflow, or scheduled operation in Task Center.

1. Purpose

1.1 What Session Management Solves

Session Management is where work starts and where users and Rex move a task forward together. It is not a generic chat window. It is Flocks' task session space.

A session can contain:

• Task goals, additional clues, and user feedback.
• Rex's task decomposition, tool calls, sub-agent delegation, and result summaries.
• Files, reports, JSON results, and intermediate evidence produced during execution.
• Context for later turning the work into an Agent, Skill, Workflow, or scheduled task.

Rex conversations triggered from different product areas are all collected on the Session Management page. For example, Rex conversations opened while creating or adjusting an Agent on the Agent page, or while generating or debugging a workflow on the Workflow page, are also recorded as sessions. This lets users review all task context from one entry point without remembering which feature page started the conversation.

1.2 Relationship with Other Modules

Module	Relationship
Agent	Sessions are handled by Rex by default, and can also be switched directly to a specific sub-agent.
Skills	Rex can load a Skill in a session, or turn successful experience into a Skill.
Workflow	You can create, run, modify, and test Workflows in a session; Rex conversations from the Workflow page also appear in Session Management.
Tools	Rex calls tools as needed, and can also generate new tools through a session.
Workspace	Session outputs are usually written to the current Workspace's outputs/.

2. Use Cases

Session Management is suitable for any task that starts from natural language, for example:

• Triage one alert or a batch of alerts.
• Query IOCs, enrich threat intelligence, and generate reports.
• Log in to device consoles for inspection or data collection.
• Integrate APIs, MCP, IM channels, or security devices.
• Create Agents, Skills, and Workflows.
• Enable the SOC Workspace scenario suite from the Alert Operations entry point.
• Turn a proven flow into a recurring task in Task Center.

If the task is still unclear and requires iterative questions and execution, start from a session. Once the flow is stable, promote it to a Workflow or Task Center.

3. How to Use

3.1 Create a Session and State the Goal

Go to AI Workspace -> Session Management and describe the goal directly:

Help me analyze this batch of NDR alerts and output the high-risk alert list, evidence, and handling recommendations.

The clearer the description, the easier it is for Rex to select the right tools, Skills, Workflows, or sub-agents. Include the input data, target systems, expected output, time range, and constraints when possible.

3.2 Start the SOC Workspace from Alert Operations

The new-session home page provides an Alert Operations shortcut. After you click it, if the SOC Workspace scenario suite has not been installed, the page prompts you to install it. After confirmation, Flocks installs the SOC Workspace UI, SOC Workspace operation tools, alert denoising workflow, and alert triage workflow, then enters the Rex-assisted configuration flow.

After installation, Rex continues guiding the configuration of stream_alert_denoise and stream_alert_triage, moving alert operations from installed to usable. For the full flow, see SOC Workspace Scenario Suite.

3.3 Rex Runs by Default

The current Session conversation selects the main Agent, Rex, by default. Rex decides whether to handle the task itself, delegate it to an expert Agent, or run a Workflow.

You usually do not need to specify an Agent name. Just state the task:

Run the device inspection.

If you want to consistently select a specific Agent, say so explicitly:

Use Security Inspection Agent to complete this device inspection.

3.4 Select a sub-agent Directly

There are three common ways to use a specific sub-agent:

Method	Effect
Tell Rex in natural language	For example, "Use Security Inspection Agent to complete this device inspection." Rex understands the instruction and delegates to that sub-agent.
@ a sub-agent in the input	For example, @security-inspection analyze this batch of inspection data. This is useful when you want to explicitly name a sub-agent for the task.
Select the conversation Agent on the page	Switch the current session directly to an Agent, which then handles the following conversation.

All of these methods can route the task consistently to a specific sub-agent. The difference is that when you specify it in natural language, Rex still acts as the main entry point for understanding and delegation. When you use @sub-agent or select an Agent on the page, the intent is more direct and better suited to debugging or fixing the execution role.

Using a specific sub-agent directly is suitable for:

• Debugging an Agent's Prompt.
• Verifying that an Agent can complete a task independently.
• Bypassing Rex's automatic matching and fixing the expert role.

3.5 Turn Session Work into Reusable Capabilities

After a task succeeds, you can continue by saying to Rex:

Based on the execution process just now, help me create a reusable Agent.

You can also turn it into a Skill or Workflow:

Organize the judgment method from just now into a Skill.

Create a Workflow from the process just now and keep the test data.

3.6 / Commands in Sessions

You can use / commands in the conversation input box to quickly view capabilities, switch session state, or trigger specific operations. Commands may vary slightly by entry point. The most accurate list is available by entering:

/help

Common commands include:

Command	Purpose
/new	Clear the current conversation history and start a new conversation. /reset may also be supported as an alias.
/help	View all / commands supported by the current entry point.
/tools	View currently available tools. Supports /tools info <name>, /tools refresh, and /tools create <requirement>.
/mcp	View MCP services. Supports /mcp status, /mcp tools, and /mcp refresh <server>.
/skills	View currently available Skills. Supports /skills refresh.
/agents	View Agents that can currently be delegated to.
/workflows	View currently available Workflows.
/tasks	View the Task Center overview.
/queue	View task queue status.
/compact	Summarize and compress the current session context, useful for continuing long conversations.
/clear	Clear the current UI output. This does not delete real session data.
/plan <task>	Ask Plan Agent to create a plan for the task.
/ask <question>	Ask only, without making changes. Useful for consultation or confirming an approach.
/init	Analyze the current project and create or update project-level Agent guidance.
/bug <description>	Organize or submit issue feedback.
/model <model>	Switch or view the current model, mainly for channel or session control scenarios.
/status	View the current session status, mainly for channel or session control scenarios.

Flocks can also discover more / commands from custom command directories and MCP Prompts. Therefore, /help may show different commands across projects, Workspaces, or MCP configurations.

3.7 Send Messages to a Fixed Session with session_id

Each conversation has a unique session_id. Flocks injects the current Session ID into the Agent runtime context, so you can ask in any session:

What is your session_id?

Rex returns the current session's session_id. In IM channels, you can also use:

/status

to view the Session, Agent, model, and channel target bound to the current IM conversation.

After you have the session_id, you can ask Rex from another Flocks session to send a message to that fixed session:

Send to session_id: <session_id>: inspection is complete, there are 2 high-risk alerts, and the report is in outputs/2026-06-10/report.md.

Rex calls the channel messaging capability, uses the session_id to find the bound IM conversation automatically, then sends the message back to the corresponding WeCom, Feishu, or DingTalk conversation. The user only needs to provide the Flocks session_id; they do not need to know how the IM platform identifies group chats or private chats internally.

This capability is especially useful for IM conversations. Each IM private chat, group chat, or isolated sub-session inside a group maps to a Flocks Session. As long as you first ask for the session_id in the target IM conversation, you can later push results back to that IM conversation consistently from WebUI, another session, Task Center, or a Workflow.

Common uses include:

• Push inspection results, alert triage results, daily reports, and similar task outputs to a fixed duty group.
• Sync progress from a WebUI session to a specific IM group.
• Write the target session_id into the task description when creating a scheduled task, so unattended runs can still find the correct recipient.
• Avoid ambiguous targets like "send it to WeCom" when multiple IM groups are connected.

Recommendations:

• session_id is a routing identifier. Before sending sensitive content, confirm that it belongs to the correct group chat or user.
• If the target IM conversation has run /new, it generates and binds a new Session, so the old session_id may no longer be the expected target.
• If sending fails, check whether the target Session really comes from an IM channel, whether the channel is online, and whether the bot is still in the target group.

4. FAQ

4.1 How Are Sessions and Workspace Related?

Sessions handle interaction and task context. Workspace handles project boundaries and file outputs. Reports, test data, and intermediate results generated by Rex in a session are usually written to the current Workspace's outputs/.

4.2 Can a Session Run a Workflow Directly?

Yes. Say:

Help me run this batch of alerts with the NDR alert triage workflow.

Rex locates the appropriate Workflow and passes the input data to it for execution.

4.3 Can Session Results Become Scheduled Operations?

Yes. First run the flow successfully in a session, then ask Rex to create a task:

Configure this inspection flow as a task that runs every day at 08:00 and sends results to the WeCom duty group.

5. Related Modules

• Task Center: Turn capabilities proven in sessions into scheduled operations.
• Agent: Execution roles that can be delegated to or selected directly in sessions.
• Workflow: Stable processes that can be created and run in sessions.
• Skills: Methodologies that can be loaded or created from sessions.
• Workspace: Storage location for session outputs and project assets.