Scenario Practices
This page organizes typical Flocks deployment scenarios around common security operations workflows. Each scenario is described in terms of inputs, processing flow, outputs, and continuous operation, so teams can choose the right capability mix for real projects.
Find a Scenario by Problem
| Problem to solve | Recommended scenario |
|---|---|
| Too many alerts, and I do not know which to handle first | Alert triage, alert denoising |
| Quickly enable a SOC alert operations workspace | SOC workspace scenario suite, alert denoising, alert triage |
| Turn alert handling into continuous operations | Alert triage, Task Center |
| Connect internal security devices and run inspections | Device integration and inspection, device management |
| Look up IOC / domain / IP profiles | Threat intelligence and IOC triage, internal IP asset profiling |
| Investigate suspicious host behavior | Host inspection / incident forensics |
| Map or verify assets and exposure | Internet asset discovery |
| Keep an operation running over time | Workflow, Task Center |
Core Scenarios
SOC Workspace Scenario Suite
Install the SOC workspace UI, SOC workspace operations tool, alert denoising Workflow, and alert triage Workflow required for alert operations in one step. You can trigger installation from the Alert Operations entry on the new session home page, or install and uninstall it by selecting the Scenario Suite type in Flocks Hub.
Typical outputs: SOC workspace page · Alert denoising results · Structured triage report · Workflow combination for continuous operations
Alert Denoising
Filter, aggregate, and perform initial prioritization on large volumes of alerts generated by TDP / NDR / XDR and similar devices. This scenario is usually deployed on a cloud host or internal VM to ensure that device Syslog or API data paths can reliably reach Flocks.
Sub-scenario: Real-time NDR Alert Denoising Workflow
Typical outputs: Merged duplicate alerts · High-priority alert summary · Channel notifications
Alert Triage
Fetch alerts from TDP / NDR / XDR and similar devices, delegate per-alert analysis to a dedicated Agent, output structured JSON, and send notifications through channels. The process can then be promoted to a scheduled task. This is one of the easiest Flocks scenarios to deploy and turn into continuous value.
Sub-scenario: Batch NDR Triage Workflow
Typical outputs: Structured triage results · JSON report · WeCom / DingTalk notifications
Host Inspection / Incident Forensics
The host inspection Agent first runs baseline checks, then enters deeper investigation based on anomalies. Command allowlists, blocklists, and per-command human confirmation control high-risk operations, and the final output is an investigation report with a timeline and evidence chain.
Typical outputs: Baseline report · Intrusion timeline · IOC / mining pool address / persistence method
Device Integration and Inspection
First connect TDP / NDR / HIDS / EDR / firewalls and other security devices through Device Management, then have the device inspection sub-agent periodically read health status, rule libraries, logs, and performance metrics, summarize them into an inspection report, and notify on anomalies.
Typical outputs: Connected device inventory · Inspection health table · Anomaly summary · Channel notification
Threat Intelligence and IOC Triage
After you provide an IP, domain, or hash, Rex can query intelligence sources such as ThreatBook, VT, and GreyNoise in parallel, cross-check the findings against enterprise context, and output an evidence-backed triage conclusion. The flow can be extended to batch triage and continuous tracking tasks.
Typical outputs: IOC triage conclusion · Batch IOC table · Continuous tracking for key IOCs
Internet Asset Discovery
After you provide a domain or company name, the platform can perform multi-source discovery, classification and aggregation, CMDB correlation, and risk tagging. Combined with scheduled asset diff tasks, it can automatically notify when new or changed assets appear. This is a core capability for attack surface management (ASM).
Typical outputs: Asset inventory · Classification view · Risk Top N · Asset change diff
Shared Product Logic
Although these scenarios target different problem areas, they follow the same Flocks pattern:
- Rex understands the task -> breaks it into steps and selects capabilities
- Dispatches expert Agents / tools / Workflow -> executes actions
- Persists intermediate data + structured outputs -> produces reviewable and reusable results
- Channel notifications + scheduled tasks -> upgrades one-off handling into routine operations
- Captures experience as Skills -> makes similar tasks reusable
Scenario practices apply the same capability backbone to different problem domains. This is why Flocks is positioned as an agent-powered SecOps platform, not a single AI feature.
Related Resources: Project Overview · Quick Start · Feature Modules · Deployment and Configuration · Task Center · Flocks Hub