Unverified50% confidenceDecision RuleExact time
Sophos has defined three operating modes: Notify (notification only, providing recommendations without taking response action), Collaborate (collaboration, where response requires direct customer involvement), and Authorize (authorization, where Sophos can respond directly on behalf of the customer)
1
Sources
50%
Confidence
Long-term
Relevance
9/30/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe core of traditional SOAR (Security Orchestration, Automation and Response) is predefined playbooks, where when a certain type of alert is triggered, the system executes a fixed process written in advance by humans.56% similarUnverified将SOP作为Agent的动态知识库形成「执行→复盘→更新→再执行」的闭环迭代，通常依赖工具调用（Function Calling）能力实现55% similarUnverifiedSOAR (Security Orchestration, Automation and Response) is currently the most mainstream type of automation platform in SOCs, automatically handling tasks such as alert triage, ticket creation, and threat intelligence queries through pre-written playbooks.53% similarUnverifiedThe message-passing paradigm can be decomposed into three steps: Message, Aggregate, and Update.52% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/960952API
curl https://kongchang.com/api/v1/knowledge/claims/960952MCP
get_claim(id=960952)