> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt
> Use this file to discover all available pages before exploring further.

# SOCFortress Capsules

> Operator playbooks that walk you from alert → investigation → response using CoPilot.

Capsules are short, task-focused operator playbooks based on SOCFortress video walkthroughs.

Use them when you want a **step-by-step path** from an alert to investigation and response inside CoPilot.

***

## Quick start: pick a goal

* **Contain a host from a C2 alert** → [C2 alert to containment](/user/capsules/c2-alert-to-containment)
* **Investigate suspicious persistence** → [Suspicious scheduled tasks](/user/capsules/suspicious-scheduled-tasks)
* **Remove unauthorized privilege** → [Rogue local admin accounts](/user/capsules/rogue-local-admin-accounts)
* **Validate a detection** → [Atomic Red Team validation](/user/capsules/validate-detections-atomic-red-team)
* **Run response actions** → [Endpoint response actions](/user/capsules/endpoint-response-actions-copilot)
* **Memory forensics / malware hunting** → [Volatility 3 malware hunting](/user/capsules/volatility-3-malware-hunting)

***

## Capsules by category

<details>
  <summary><strong>Incident Response Playbooks</strong></summary>

  * [Step-by-Step IR: From C2 Alert to Full Containment](/user/capsules/c2-alert-to-containment)
  * [SOC Playbook: Detecting and Removing Suspicious Scheduled Tasks](/user/capsules/suspicious-scheduled-tasks)
  * [Detecting & Removing Rogue Local Admin Accounts](/user/capsules/rogue-local-admin-accounts)
</details>

<details>
  <summary><strong>CoPilot How-Tos</strong></summary>

  * [Endpoint Response Actions with CoPilot](/user/capsules/endpoint-response-actions-copilot)
  * [Validate Detections with Atomic Red Team (CoPilot)](/user/capsules/validate-detections-atomic-red-team)
</details>

<details>
  <summary><strong>Forensics</strong></summary>

  * [Volatility 3 Malware Hunting (Full Tutorial)](/user/capsules/volatility-3-malware-hunting)
</details>

***

## What each capsule includes

* What you’re trying to accomplish
* When to use it (what kind of alert/context)
* Prerequisites (data sources + access)
* Step-by-step procedure
* Validation (“what good looks like”)
* Safety notes (containment vs evidence preservation)
* Video link