Cybersecurity
Threat hunting, SOC investigation and configuration auditing — the vertical that proves the platform, because its agents ship.
- Investigate this incident across SIEM, EDR and hosts.
- Investigate this QRadar offence against Carbon Black and the IIS host it points to.
- Which hosts are missing the EDR sensor, and why did the install fail on each one?
حقّق في هذه الحادثة عبر SIEM وEDR والخوادم.
- Host workers on Linux, Windows and macOS
- Read-only by default, full policy per host
- Signed skill catalogue and customer uploads
- Fleet ask with evidence per host
- Workspaces and OIDC identity
- Self-host in one command
- Agents as objects
- Skill capability manifests
- Missions with scope and time limit
- Evidence store
- SIEM and EDR connectors
- Human approval before containment
What the security team is asking for
An alert fires. The analyst needs the process tree from the endpoint tool, the authentication trail from the log platform, and what is actually on the server right now — and needs to be sure that looking does not change anything. Most of the shift goes into collecting, and the write-up is the part that gets cut.
- Follow one alert across the log platform, the endpoint tool and the machine itself.
- Audit a configuration across the whole estate and get a per-machine answer, not a sample.
- Prove what was checked, on which host, with which command — months later.
- Be certain an investigation cannot change a system by accident.
Why this vertical is the proof
Security is the hardest thing to build: real execution on real machines, reasoning across several systems, permissions that hold, evidence that survives an audit, and a human gate before anything is changed. It is built here first because it is the part that cannot be faked.
A security investigation and a university policy question are different combinations of the same primitives.
Hosts are the execution and evidence workers
A small agent runs on each enrolled machine — Linux, Windows or macOS. The model never touches the machine; it asks the host worker to run an approved diagnostic, and the worker returns the command, the exit code and the output.
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Every answer shows the exact commands that ran, their exit codes and output, per host.
The skills an investigation may use
Skills come from a signed vendor catalogue or your own uploads, and can be enabled or disabled per workspace.
The built-in catalogue is written for investigation rather than for chat — each skill names the evidence to collect, in what order, and what it must not touch:
- linux-host-triage
- windows-host-triage
- active-directory-investigation
- identity-dns-edr
- file-provenance
- infrastructure-incident-rca
- exchange-server-triage
- network-firewall-triage
- storage-filesystem-triage
- kubernetes-cluster-triage
- virtualization-platform-triage
A skill declares what it can and cannot do, the tools it needs, the paths it may read, and how it is evaluated.
How an investigation is carried out
An agent is a model, a set of approved skills, tools and a policy, applied to a scope.
Agents reach your systems through approved connectors — APIs, databases, applications — each with its own permissions.
Changes wait for human approval before they run.
Where it runs
The whole stack self-hosts with one command; an air-gap bundle ships every image.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Sign in with your own identity provider (OIDC with PKCE); no shipped default administrator password.
Customer-controlled inference and execution boundaries.
Bring one question of your own.
Request a demo