Operations

Plan and execute security operations — from AI-assisted red teaming to multiplayer CLI engagements.

---

What is an Operation?

An Operation is a coordinated sequence of security actions performed against a target. Operations can be investigative or offensive in nature, performed with or without initial access, and can contain multiple parallel streams of work. Use them for red team missions, adversary emulation exercises, training, or live investigation of your environments.

Method provides two ways to run Operations: Operator (a visual workspace) and Overwatch (a CLI for local tooling). Both can be accessed from within the Operations application in the sidebar.

---

Operator

Operator is the primary workspace for running Operations. It serves as an IDE for Security Engineering and Offensive Engineering workflows, with Tools, Ontology data, and AI at your fingertips.

The workspace

The Operator workspace is built around a central graph canvas:

• Left panel: Contains AI chat, Operation objectives, Rules of Engagement, adversary intelligence, and the complete Tool Library
• Central graph: Visualizes the steps taken in your operation. Nodes represent Tool executions; edges show data types flowing between them. For Operations in a target network (not the open web), switch tabs to see a Network Map of the target network.
• Right panel: Objects and Issues discovered. Select a node to filter to that step’s findings, or deselect to see the full operation lineage

Operating modes

Operator offers three modes:

• Manual mode: Fully operator-driven. No AI suggestions for tool executions, but you can still use chat with AI for questions and analysis.
• Co-pilot mode: Human-in-the-loop, AI-assisted operation. You receive AI-suggested tool recommendations based on the mission objective, recent findings, environmental context, and adversary intelligence. Accept or decline each recommendation before execution.
• Auto mode: The system runs completely autonomously within pre-defined guardrails set by the operator.

You can learn more about Co-pilot and Full Auto mode in Operator AI.

Adversary emulation

Operations can include Adversaries, created from uploaded adversary intelligence, to power AI-driven adversary emulation. When an Adversary is selected, Operator AI suggestions reflect how that adversary would behave against your targets. You can chat with the Operation AI to learn about how the adversary would think about your targets.

Rules of Engagement

Operations support configurable guardrails: No Strike lists, restricted tool executions, and operational risk controls that enforce safety boundaries during execution.

Object Watch

Declare specific Object Types of interest; the system passively monitors for them and alerts you when they are discovered during an operation.

Method Tools

Operator leverages Method’s full suite of tools. You can explore them in the Tool Library, in the left panel. As you progress through your operation, only the tools that are applicable to the data you have discovered are suggested.

---

Overwatch

Overwatch is a cross-platform CLI for running operations locally using your own tools, while integrating with the full Method platform.

Session recording

Overwatch records all commands entered, their outputs, and relevant metadata. Terminal session recording is modeled after tools like asciinema, enabling accurate playback and review.

Collaboration

Multiple operators can join the same Overwatch session from their respective terminals. Overwatch tracks each operator’s commands and funnels them into a single session for unified tracking and reporting.

In-platform IDE

When you open an Overwatch session in Method, you work in a dedicated workspace view. The workspace surfaces your timeline of commands and events in the left panel, with an AI chat panel alongside it. You can annotate timeline events with notes, upload source files as evidence, and drag events directly into chat as attachments.

The Timeline tab includes a persistent control bar for three quick actions:

• Add Note: Attach a freeform note to the timeline
• Paste Command: Log a command directly without running it through the Overwatch CLI
• Upload File: Attach any file as a source to the session

For FQDN and IP objects discovered during a session, use the Enrich Target action to run enrichment with device class and vendor information.

Agent mode

Each Overwatch session has a configurable agent mode that controls how AI recommendations are generated:

• Manual: No automatic recommendations. Use chat to ask questions or run analysis on demand.
• Objects only: The AI recommends object-level actions based on what you discover.
• Copilot: Full copilot mode. The AI proactively surfaces recommendations as you work.

Your mode preference is saved per session.

Report generation

Use Overwatch’s timeline history to filter or curate command logs, then generate a Report with a single click.