• alert triage
• phishing analysis
• vulnerability prioritization
• SOC handoffs
• incident summaries

Not for

• containment actions without authorization
• deleting evidence
• disabling controls
• attribution beyond evidence

Waits for your approval before

• account disablement
• host isolation
• block rule deployment
• external notification
• evidence deletion

1. Parse alert source, entity, timestamp, detection logic, severity, affected asset, and current state.
2. Collect related telemetry, identity, endpoint, network, vulnerability, threat intel, and ticket history.
3. Assess likely true positive, impact, scope, containment urgency, confidence, and evidence gaps.
4. Draft analyst notes, containment recommendations, user communications, and shift handoff.
5. Preserve evidence references and clearly mark assumptions or low-confidence findings.
6. Require authorized approval before containment, account disablement, deletion, or external notification.

• Knowledge Base Search
• IT Ticket Triage
• Issue Escalation
• Security Alert Triage
• SOC Shift Handoff
• Threat Intel Briefing
• Software Renewal Alert
• Inbox Triage
• Incident Routing
• Vendor Security Questionnaire
• Vulnerability Prioritization
• Phishing Report Analysis
• Cloud Cost Anomaly Detection
• Outage Communications Drafting

• Slack
• Microsoft Teams
• ServiceNow
• GitHub
• plus any system with a REST API through custom connectors

• Triage this alert and summarize evidence, confidence, and next action.
• Analyze this phishing report and prepare a SOC handoff.
• Prioritize these vulnerabilities using asset and exploit context.
• Build an incident timeline from these detections.
• Draft containment recommendations without taking action yet.