Morpheus Adaptive Tasking

When you run /Investigate, Morpheus:

1. Reads the incident, including any earlier findings and runs on it.

2. Searches your SOPs and uses one that fits the incident (see /SOPs).

3. Builds a plan of up to eight steps. Each step names the integration and command that carries it out.

You can then run the plan's tasks, or ask Morpheus to regenerate the plan. A task that depends on another task waits until that task is done.

Generates a summary of the incident and the work done on it, including:

• A headline and the verdict.

• What happened, what was done and what is still pending.

• An assessment and the key findings.

• Recommended next steps.

A summary of the whole incident replaces the incident's AI summary, and it is saved as memory for the incident. Later investigations of similar incidents can find it. See Memory and Rules.

Opens the playbook panel, where you pick an investigation playbook to run against the incident.

Drafts an SOP skill from the current conversation. It needs at least one exchange with Morpheus on the incident; the menu row shows the count (for example, 1 exchange).

The draft opens in the New SOP Skill window under Draft from this conversation. Click Choose what to capture to pick what goes into the draft. You can also open this window from New SOP Skill in SOP Management (see Method 2).

What is an SOP?

An SOP (standard operating procedure) is a written investigation procedure: the steps to take, and in which order, for a kind of incident. In 18.6 the panel calls them SOP skills.

Example phishing sop

• Check sender domain reputation

• Extract URLs and hashes

• Query VirusTotal

• Search SIEM for affected users

• Check user interaction

• Block sender if malicious

When Morpheus builds an investigation plan, it searches the active SOPs and follows one that fits the incident, combined with the incident's own data.

SOP Types

SOP Management

Choose /SOPs to open SOP Management. It lists the SOP skills for the current incident type, grouped as PERSONAL and SHARED, with a search box (Search procedures...) and a status filter.

How to Create SOPs

• Method 1: Manual Creation

  1. Choose /SOPs, then click + New SOP Skill.

  2. In the New SOP Skill window, enter the procedure in SOP Skill (Markdown; use Preview to check it). Then set:

     • Skill name (optional): if left empty, a name is made from the skill.

     • Description (optional): when the skill applies, in one sentence.

     • Category (optional).

     • Scope: Personal or Shared.

     • Incident Types: the incident types the skill applies to.

     • Sites: the sites the skill applies to.

  3. Click Create SOP Skill.

• Method 2: Draft from an Investigation

  1. Work the incident with Morpheus (at least one exchange).

  2. Choose /Turn-into-SOP, or click + New SOP Skill and use Draft from this conversation > Choose what to capture.

  3. Review the draft, then click Create SOP Skill.

How to Apply SOPs

Morpheus looks for a fitting SOP on its own when it builds a plan. To apply a specific SOP, click the SOP in SOP Management to open its details, then click Apply SOP Skill.

SOP Management Operations

Opens Rule Management, where you add, view, turn on or off, and delete the rules Morpheus must always follow. See Memory and Rules.

Opens the playbook panel to browse the saved Adaptive Playbooks.

Clears the chat and starts a new session. Use it to start a new investigation or change direction. Earlier sessions stay under Conversation history in the panel header.

Runs integration commands on request.

Example Use Cases

• Checking IP, domain, or hash reputation

• Searching for SIEM alerts

• Blocking hosts

Example Phrasings

Morpheus finds the command among your integrations and fills in its parameters. Read-only commands run straight away; commands that change something ask for approval first (see Action Approvals and Safety Guardrails). Naming the integration and the target helps it pick the right command.

Builds a structured investigation plan. Use /Investigate, or ask in plain language.

Example Phrasings

Analyzes the incident and the work done on it. /Summarize always produces the structured summary described in /Summarize.

Example Phrasings

Searches the internet for security information.

Example Use Cases

• Looking up CVE details

• Retrieving malware analysis reports

• Retrieving attack technique descriptions

• Accessing other relevant public information

Example Phrasings

Say "on the web" when you want a web search. "Search Sentinel for alerts" is a request to run a command, not a web search.

Finds, applies or creates SOPs. Use /SOPs or /Turn-into-SOP, or ask in plain language.

Example Phrasings

Runs tasks from the investigation plan.

Example Phrasings

Answers questions on security topics without running anything.

Example Use Cases

• Asking about security concepts

• Asking about attack techniques

• Asking about SOC best practices

• Asking about how to use the D3 platform

Example Phrasings

Morpheus can also draw on memory, such as summaries of similar incidents, and on your SOPs. See Memory and Rules.

User initiates a full incident investigation. The system generates a multi-step plan, executes tasks, and produces a summary report, with an option to save the workflow as an SOP.

1. Enter /Investigate in the chat.

2. Review the generated plan.

3. Run the plan's tasks.

4. Enter /Summarize in the chat to generate a report.

5. (Optional) Choose /Turn-into-SOP to save the investigation as an SOP skill.

User requests an IOC reputation check. The system finds the command, runs it, and returns results.

Example flow

User: Check reputation for hash 44d88612fea8a8f36de82e1278abb02f using VirusTotal.

Adaptive Tasking: Runs the read-only command → Returns VT analysis results

User requests alert search in MS Sentinel. The system runs the query and returns matching alerts.

User: Search MS Sentinel for alerts related to 192.168.1.100 in the last 24 hours

Adaptive Tasking: Runs the read-only search → Returns alert list

User asks about a MITRE ATT&CK technique. The system provides a direct answer without executing actions.

Example flow

User: What is MITRE ATT&CK technique T1059?

Adaptive Tasking: Provides a direct explanation without executing any actions

User requests an incident update. The system identifies the operation, asks for approval, and applies the change.

Example flow

User: Change the severity of this incident to Critical

Adaptive Tasking: Identifies as D3 incident operation → Approval card (Approve) → Updates severity

An ad-hoc investigation plan generated from incident context.

Example

Situation: A PowerShell execution alert occurs on host FIN-WS-04 by user john.doe, with no matching SOP.

Execution:

• User enters /Investigate.

• The system finds no fitting SOP and generates a plan using available integrations and context.

• Example plan:

  1. Enrich the user via Active Directory.

  2. Retrieve the PowerShell command from EDR.

  3. Extract IOCs from the command.

  4. Check IOC reputation.

  5. Search related SIEM activity.

After execution, the investigation can be saved as an SOP skill with /Turn-into-SOP.

An ad-hoc investigation plan generated for an unfamiliar technique.

Example

Situation: An alert mapped to MITRE T1528 (Steal Application Access Token) with no existing SOP or playbook.

Execution:

• User enters /Investigate.

• The system builds a plan using MITRE mapping and available incident data (user, application, scopes, source IP).

• Example plan:

  1. Retrieve OAuth app grants for the target user (last 30 days).

  2. Analyze granted scopes and identify high-privilege permissions.

  3. Enrich the source IP using a reputation service.

  4. Search for related sign-in activity from the IP across all users.

  5. Review mailbox rules and forwarding settings for persistence.