Examples

Things to ask once your assistant is connected:

Triage

• "How many critical alerts did we get in the last 24 hours, and on which hosts?"
• "Give me a severity breakdown of this week's alerts for the production workspace."
• "Are there any active container_escape or vm_escape alerts right now?"

Investigation

• "Show me the details and timeline of the most recent gpu_ransomware alert."
• "What alerts has gpu-node-17 generated today? Walk me through the process timeline of the worst one."

Reporting

• "Which workspace is generating the most alerts this month, and of what types?"
• "Summarize this week's security posture across the fleet in a few sentences."