Ask anything. Across everything.
Copilot is a virtual analyst you can speak to in plain English. Ad-hoc investigations, cross-platform queries, proposed actions, all on the same audit log as the autonomous agent.
A virtual analyst on tap.
The same reasoning engine as the autonomous agent, available on demand for anything the queue does not cover.
Plain English, across everything
Ask in natural language. The agent works out which platforms to hit, which queries to run and which tools to call across your stack.
Ad-hoc and on-demand
Use it for daily threat hunts, one-off investigations, quick queries, anything that does not go through the autonomous alert queue.
Proposed actions, your approval
When you ask it to do something that changes your environment, the agent proposes the action with target, evidence and justification. Approve in the chat.
Same audit trail
Every tool call, every result and every approved action goes on the same audit log as the autonomous agent. One record, one source of truth.
What you can ask it.
The autonomous agent handles the queue. The copilot is what you turn to for everything else.
Follow up on a triage
Open Copilot on a specific alert to question the verdict, test a different hypothesis, or pull more context without losing the trail.
Daily threat hunts
Ask the agent to look for patterns of concern across the past day, week or month, in plain English.
Cross-platform investigations
Investigate a domain, pull recent activity for a user, check a hash, all in one conversation across your SIEM, EDR, identity and intel.
Plain-English execution
Block an IP, contain a host, disable an account, draft a suppression rule. Always proposed first, approved by you.
Put a virtual analyst on call.
Thirty minutes with our team. Bring real questions about your environment, watch the agent investigate, query and propose actions in plain English. No slide deck.