Skip to main content
When you deploy the XDR + SIEM module or Agent Center, ContraForce creates Azure resources in your subscription.

​
Resources Deployed by Module

​
XDR + SIEM Module

  • Logic Apps for incident ingestion and event processing
  • Azure Lighthouse delegations for cross-tenant management
  • Resource group for ContraForce-managed resources

​
Agent Center

  • Azure AI Foundry resources for SDA processing
  • Supporting compute and storage resources

​
Important Notes

  • All resources are deployed in the Azure subscription you select during onboarding
  • You need Subscription Owner access for deployment
  • Resources can be viewed in the Azure Portal under the ContraForce resource group
  • Do not manually delete or modify ContraForce-managed resources — this can break platform functionality
If a Logic App becomes disabled, it may need to be manually re-enabled in the Azure Portal. See Agent Center Issues.
For the full resource list, see Azure Resources Deployed.