Bring your own AI
Evidence, not guesses. Assistance, not autonomy.
Connect your own AI provider, whether Anthropic (Claude), OpenAI, Google, or a self-hosted model. Playbooks handle routine automation; for advanced reasoning, Response Ops calls your AI to triage, investigate, and suggest next steps. It never takes a privileged action, and it stays off for each client until you switch it on.
- OBSERVED FACTS
- AI ASSESSMENT
- SUGGESTION
- HUMAN APPROVAL
Built on real product foundations
Command AI works from the data technicians already use: monitoring and policy results, endpoint health, Microsoft 365 detections, and Service Desk tickets. It suggests; technicians decide and act.
From ticket to resolution
One step at a time
An example investigation, step by step. The evidence, the AI’s assessment, and its suggestions stay in separate sections.
Gather
Observed factsCommand AI assembles ticket history and related context: endpoint, customer, and prior activity.
- Service DeskTicket #4821 — "VPN drops + MFA prompts" · 3 linked assets09:41
- Overwatch14 endpoint events on DESKTOP-7F pulled09:41
- Tickets2 earlier tickets from the same user found09:42
Correlate
Observed factsSignals are correlated across Windows monitoring, cloud alerts, and ticket history to surface likely relationships on the same device.
- Windows Mon.Repeated failed logon spikes on DESKTOP-7F09:38
- Aegis / M365Impossible-travel sign-in anomaly, same user09:29
- PolicyDevice out of compliance with hardening baseline08:55
Summarize
AI assessmentA summary separates the evidence from the AI’s assessment and shows which evidence was missing.
- AssessmentLikely credential compromise on DESKTOP-7F09:43
- Coverage2 of 3 expected evidence sources present09:43
- GapNo EDR process telemetry available yet09:43
Recommend
SuggestionCommand AI suggests investigation and remediation steps, and which module would perform each one.
- ActionIsolate DESKTOP-7F via Overwatch—
- ActionReset the user’s Microsoft 365 password—
- ActionOpen a ticket for the patch backlog—
Approve
GatedCommand AI never takes a privileged action. A technician reviews and runs each step, typing the device or account name to confirm.
- ApprovalAwaiting technician review — type the hostname to confirmpending
- AuditAI call recorded09:44
- SafetyStands down if the incident goes stale—
Technician assistance, not a chatbot or an autonomous tech
What it does
- Automatically gathers relevant ticket history and context
- Correlates Windows monitoring, cloud alerts, and ticket history
- Summarizes evidence and likely relationships
- Suggests investigation and remediation steps
- Reduces manual tool switching and repetitive data collection
What it does not do
- Take a privileged action on its own
- Act on a stale incident or an unclear answer
- Run for a client that has not switched it on
The safeguards in place today
Bring your own AI, off by default
You connect your own AI provider and key (stored encrypted). AI stays off for each client until an administrator switches it on and records consent.
Evidence kept separate
Deep investigation keeps the evidence, the AI’s assessment, and its suggestions in separate sections.
Coverage and gaps shown
Investigate shows how much of the evidence it covered and what was missing.
Untrusted input handled as untrusted
In triage and investigation, ticket and alert text is wrapped as untrusted input before the model sees it.
No privileged action by AI
No AI path takes a privileged action. A technician runs each one and types the target device or account name to confirm; the highest-risk endpoint actions also need a press and hold.
Holds instead of guessing
Investigation stands down on stale incidents and puts an unclear answer on hold instead of acting on it.
Bring your AI. Keep your rules.
Connect the provider you already trust, switch it on per client, and see how it categorizes and triages your real tickets during a free pilot.