Morpheus Adaptive Tasking

When triggered:

1. Gather context: Fetch IOCs, alert sources, entities, MITRE ATT&CK mappings, raw event data, and relevant memory from past incidents.

2. Match SOPs: Search for applicable SOPs.

3. Generate plan: Create a 3–8 step plan mapped to integrations.

4. Resolve tasks: Map steps to concrete integration commands.

After generation:

• Execute tasks step by step.

• Regenerate the plan based on updated context.

Generates an analysis report including:

• Key findings and evidence.

• Threat verdict.

• Recommended next steps.

The summary is saved as memory and reused in future investigations.

What is an SOP?

An SOP (standard operating procedure) defines a predefined investigation template that outlines the steps and the order in which they are performed, for a specific incident type.

Example phishing sop

1. Check sender domain reputation

2. Extract URLs and hashes

3. Query VirusTotal

4. Search SIEM for affected users

5. Check user interaction

6. Block sender if malicious

Adaptive Tasking uses an SOP as a template and combines it with the incident’s IOCs and context to generate a customized investigation plan.

SOP Types

How to Create SOPs

• Method 1: Manual Creation

  1. Enter / in that chat, then click on the /SOPs option to open the SOP management panel.

  2. Click the + New button to open up the Create New SOP popover.

  3. Fill in the required and optional fields:

     1. Title (required)

     2. Content (required)

     3. Description (optional)

     4. Category (optional)

     5. Scope (required)

     6. Incident Types (optional)

     7. Sites (optional)

  4. Click on the Create button.

• Method 2: Auto-Create from Investigation Results

  1. Complete the investigation.

  2. Instruct Adaptive Tasking to create an SOP from the investigation.

How to Apply SOPs

1. Locate the desired SOP in the SOP management panel.

2. Click the toggle switch on the right.

With Method 2, Adaptive Tasking automatically applies an SOP when the incident type matches the SOP’s Incident Types field.

SOP Auto-Matching Logic

When a user runs /Investigate, Adaptive Tasking searches for SOPs in this priority order:

1. Exact match: Incident Type ID matches exactly

2. Keyword match: Incident Type name keyword search

3. Semantic search: RAG vector similarity match (fallback)

4. No match: No SOP used, plan generated purely from incident data

SOP Management Operations

Clears the current chat and resets the session. Use to start a new investigation or change direction.

Used to execute actions via integrations.

Example Use Cases

• Checking IP, domain, or hash reputation

• Searching for SIEM alerts

• Block hosts

What Adaptive Tasking Does

• Searches available integrations and commands.

• Asks the user to confirm the command and parameters.

• Executes after user confirmation.

• Returns the results.

Recommended Phrasings

Trigger Keywords

• Integration names: VirusTotal, AbuseIPDB, CrowdStrike, Sentinel, Shodan, Splunk, Palo Alto, Fortinet, etc.

• Action verbs: check, scan, lookup, enrich, block, quarantine, isolate, disable

Common Pitfalls

• Avoid phrases such as "show me the incident details" because they are treated as data queries and routed to chat.

• Avoid using "search for" without specifying an integration because it may be interpreted as a platform data query.

• Use action verbs such as check, scan, or block instead of question-based phrasing when execution is required.

Used when a structured and systematic investigation plan is required.

How to Trigger

• Use the /Investigate quick action

• Use natural language

Recommended Phrasings

Used to analyze an incident and produce a summary report.

How to Trigger

• Use the /Summarize quick action

• Use natural language

Recommended Phrasings

Trigger Keywords: analyze, analyse, summarize, summary

Used to search the internet for security-related information.

Example Use Cases

• Looking up CVE details

• Retrieving malware analysis reports

• Retrieving attack technique descriptions

• Accessing other relevant public information

Recommended Phrasings

Trigger Keywords: "search the web", "web search", "look up ... online"

Used to create or apply SOPs.

How to Trigger

• Use the /SOPs quick action to browse and apply

• Use natural language

Examples and Recommended Phrasings

Used to execute a task from the investigation plan.

How to Trigger

• Click on the Run button in the Plan panel.

• Use natural language.

Recommended Phrasings

Used to interact with Adaptive Tasking on security topics without triggering action execution.

Example Use Cases

• Asking about security concepts

• Asking about attack techniques

• Asking about SOC best practices

• Asking about how to use the D3 platform

Recommended Phrasings

During chat, Adaptive Tasking leverages past incident summaries, IOC history, SOPs, and built-in SOC intelligence, to retrieve relevant information without requiring explicit requests.

User initiates a full incident investigation. The system generates a multi-step plan, executes tasks sequentially, and produces a summary report, with an option to save the workflow as an SOP.

1. Enter /Investigate in the chat.

2. Review the generated plan.

3. Execute each task using the Run button.

4. Enter /Summarize in the chat to generate a report.

5. (Optional) Request SOP creation from the investigation.

User requests an IOC reputation check. The system confirms the command, executes it, and returns results.
Example flow

User: Check reputation for hash 44d88612fea8a8f36de82e1278abb02f using VirusTotal.

Adaptive Tasking: Confirms command → Executes → Returns VT analysis results

User requests alert search in MS Sentinel. The system confirms, executes the query, and returns matching alerts.

User: Search MS Sentinel for alerts related to 192.168.1.100 in the last 24 hours

Adaptive Tasking: Confirms command → Executes → Returns alert list

User asks about a MITRE ATT&CK technique. The system provides a direct answer without executing actions.

Example flow

User: What is MITRE ATT&CK technique T1059?

Adaptive Tasking: Provides a direct explanation without executing any actions

User requests an incident update. The system identifies the operation, confirms, and applies the change.

Example flow

User: Change the severity of this incident to Critical

Adaptive Tasking: Identifies as D3 incident operation → Confirms → Updates severity

An ad-hoc investigation plan generated from incident context.

Example

Situation: A PowerShell execution alert occurs on host FIN-WS-04 by user john.doe, with no matching SOP.

Execution:

• User enters /Investigate.

• The system detects no SOP and generates a plan using available integrations and context.

  • Example plan:
    1. Enrich the user via Active Directory.
    2. Retrieve the PowerShell command from EDR.
    3. Extract IOCs from the command.
    4. Check IOC reputation.
    5. Search related SIEM activity.

After execution, the investigation can be saved as an SOP for reuse.

An ad-hoc investigation plan generated for an unfamiliar technique.

Example

Situation: An alert mapped to MITRE T1528 (Steal Application Access Token) with no existing SOP or playbook.

Execution:

• User enters /Investigate.

• The system builds a plan using MITRE mapping and available incident data (user, application, scopes, source IP).

  • Example plan:
    1. Retrieve OAuth app grants for the target user (last 30 days).

    2.Analyze granted scopes and identify high-privilege permissions.

    3. Enrich the source IP using a reputation service.

    4. Search for related sign-in activity from the IP across all users.

    5. Review mailbox rules and forwarding settings for persistence.