INTELLIGENCE THAT DOES THE WORK

Put AI on
the investigation.

Give every operator an agent that can gather evidence, test hypotheses and advance the work. Your network context stays connected from the first question to the final finding.

Beyond another alert summary

Let AI do the investigation work.

A grouped alert still leaves work to do: open the right portal, identify the device, pull metrics, run a check and explain the findings. Command|Monitor gives agents tools and connected context to advance that work.

From fragmented signals

Connect supported telemetry to asset, location and service context before the investigation begins.

To evidence gathering

Agents query logs and metrics, run active checks and adapt their investigation as new evidence arrives.

To a usable finding

Operators inspect the result, supply knowledge and direct the response in CommandLink or the agreed ITSM workflow.

INSIDE THE EXPERIENCE

See the work behind the answer

Bring the workflow into focus with a view of the product in action.

14

Search Demo Company...

Illustrative UI · Sample data

Command|Link

3

operator

Back

AI follows the evidence.

Agent / Investigation

AI Investigation

The evidence points upstream.

Loss and interface errors align. Local switching remains healthy.

01

Query interface metrics

Evidence attached

02

Run active network checks

Results attached

03

Assess related events

Finding assembled

Evidence assessed

Branch 014 · last 30 minutes

WAN packet loss

Elevated

Interface errors

Aligned

Local switching

Healthy

Access points

Healthy

Operator direction

“Check the adjacent circuit.”

14

Search Demo Company...

Illustrative UI · Sample data

Command|Link

3

operator

Back

AI follows the evidence.

Agent / Investigation

AI Investigation

The evidence points upstream.

Loss and interface errors align. Local switching remains healthy.

01

Query interface metrics

Evidence attached

02

Run active network checks

Results attached

03

Assess related events

Finding assembled

Evidence assessed

Branch 014 · last 30 minutes

WAN packet loss

Elevated

Interface errors

Aligned

Local switching

Healthy

Access points

Healthy

Operator direction

“Check the adjacent circuit.”

14

Search Demo Company...

Illustrative UI · Sample data

Command|Link

3

operator

Back

AI follows the evidence.

Agent / Investigation

AI Investigation

The evidence points upstream.

Loss and interface errors align. Local switching remains healthy.

01

Query interface metrics

Evidence attached

02

Run active network checks

Results attached

03

Assess related events

Finding assembled

Evidence assessed

Branch 014 · last 30 minutes

WAN packet loss

Elevated

Interface errors

Aligned

Local switching

Healthy

Access points

Healthy

Operator direction

“Check the adjacent circuit.”

Understand. Investigate. Adapt.

A question starts the work. Evidence directs it.

Start from an alert or describe what to investigate in plain language. The agent establishes the affected scope, inspects related signals and builds an evidence-backed assessment.

Query the environment

Search logs, retrieve metrics and examine correlated alerts. Natural-language time windows become scoped queries.

Run active checks

Carry equipment context and operator feedback into the next investigation, with scoped memory and visible learning.

Adapt the investigation

Rewrite unsuccessful queries, break complex questions into smaller steps and incorporate new correlated alerts.

Work together

An investigation your team can build on.

Use a living document for findings, KPI rows, charts, event tables, topology, tool logs and human notes. Keep technical analysis and the conversation about it in context.

Inspect the evidence

Open the precise log lines, charts and raw tool results supporting a finding.

Direct the agent

Comment on findings, reply in threads and mention the AI when you want it to act. Add guidance while an investigation is running.

Reopen with new context

Return to a closed investigation with additional evidence or direction. Preserve the history as the work continues.

Learn and act

Make each investigation useful to the next.

Retain relevant equipment knowledge and operator feedback. Agents can help create and tune monitors, update case details and turn findings into reusable reporting.

Scoped operational memory

Retain preferences, constraints, equipment context and domain guidance at the appropriate user, device or company scope.

Monitoring
changes

Create, update and remove monitors through the agent workflow, with action records and limits on monitor creation.

Reports in natural language

Ask for a report, inspect its evidence charts, save it, schedule delivery or turn it into a dashboard.

Accountable by design

See what the agent did. Stay in command.

Agent activity is inspectable through tool-call records, parameters, results and duration. Durable workflows preserve progress; iteration limits and token tracking bound the work.

Search Demo Company - Command|Link...

Command|Link

3

operator

Alert Spike - WAN Edge Service

Investigation

Nov 5, 2026, 5:04 PM

3

Summary

AI

The alert spike originates from core-router-01 losing its BGP peer at 14:29 UTC. This caused OSPF adjacency failures that cascaded through the WAN Edge service, impacting 5 downstream dependencies.

Services impacted

5

Critical alerts

47

Avg latency

23ms

Throughput

640 Mbps

Findings

AI

Critical

Root cause: BGP peer failure on core-router-01

AI

BGP hold timer expired for peer 10.0.1.1 at 14:29 UTC. This is the earliest event in the cascade and directly caused OSPF adjacency loss. Recommend checking physical link to upstream provider and reviewing BGP keepalive settings.

Warning

Secondary: Possible exploit attempt during outage

AI

IPS flagged CVE-2024-3400 from 203.0.113.42 at 14:31 UTC — 2 minutes after the BGP failure. Attackers commonly probe during routing disruptions. Recommend blocking source IP and reviewing firewall logs for lateral movement.

Ask a follow-up, request deeper analysis, or suggest a hypothesis...

Summary

Components

(8)

Discuss

(3)

Private

Visible to everyone on this investigation

2 open

Command|Intel

6 minutes ago

I've flagged the CVE-2024-3400 exploit attempt as potentially related. Want me to dig deeper into the firewall logs for this source IP?

You

6 minutes ago

Yes — also check if that IP appears in any other event sources in the last 24h

Command|Intel

6 minutes ago

Checked — 203.0.113.42 appears in 3 additional firewall log entries over the past 12h, all port scans on 443/tcp. No lateral movement detected.

Reply... (use @ai)

You

6 minutes ago

Is there a redundant path through fw-edge-west? We should have a failover route configured.

Command|Intel

6 minutes ago

fw-edge-west is online and healthy, but no ECMP or failover route is configured for the BGP peer that failed. The OSPF adjacency to fw-edge-west is intact — this could be a quick mitigation path.

You

5 minutes ago

Confirmed with NOC — the upstream provider had a fibre cut at 14:28. ETA for repair is 2h.

Start a discussion... (or @ai to invoke AI)

Search Demo Company - Command|Link...

Command|Link

3

operator

Alert Spike - WAN Edge Service

Investigation

Nov 5, 2026, 5:04 PM

3

Summary

AI

The alert spike originates from core-router-01 losing its BGP peer at 14:29 UTC. This caused OSPF adjacency failures that cascaded through the WAN Edge service, impacting 5 downstream dependencies.

Services impacted

5

Critical alerts

47

Avg latency

23ms

Throughput

640 Mbps

Findings

AI

Critical

Root cause: BGP peer failure on core-router-01

AI

BGP hold timer expired for peer 10.0.1.1 at 14:29 UTC. This is the earliest event in the cascade and directly caused OSPF adjacency loss. Recommend checking physical link to upstream provider and reviewing BGP keepalive settings.

Warning

Secondary: Possible exploit attempt during outage

AI

IPS flagged CVE-2024-3400 from 203.0.113.42 at 14:31 UTC — 2 minutes after the BGP failure. Attackers commonly probe during routing disruptions. Recommend blocking source IP and reviewing firewall logs for lateral movement.

Ask a follow-up, request deeper analysis, or suggest a hypothesis...

Summary

Components

(8)

Discuss

(3)

Private

Visible to everyone on this investigation

2 open

Command|Intel

6 minutes ago

I've flagged the CVE-2024-3400 exploit attempt as potentially related. Want me to dig deeper into the firewall logs for this source IP?

You

6 minutes ago

Yes — also check if that IP appears in any other event sources in the last 24h

Command|Intel

6 minutes ago

Checked — 203.0.113.42 appears in 3 additional firewall log entries over the past 12h, all port scans on 443/tcp. No lateral movement detected.

Reply... (use @ai)

You

6 minutes ago

Is there a redundant path through fw-edge-west? We should have a failover route configured.

Command|Intel

6 minutes ago

fw-edge-west is online and healthy, but no ECMP or failover route is configured for the BGP peer that failed. The OSPF adjacency to fw-edge-west is intact — this could be a quick mitigation path.

You

5 minutes ago

Confirmed with NOC — the upstream provider had a fibre cut at 14:28. ETA for repair is 2h.

Start a discussion... (or @ai to invoke AI)

Search Demo Company - Command|Link...

Command|Link

3

operator

Alert Spike - WAN Edge Service

Investigation

Nov 5, 2026, 5:04 PM

3

Summary

AI

The alert spike originates from core-router-01 losing its BGP peer at 14:29 UTC. This caused OSPF adjacency failures that cascaded through the WAN Edge service, impacting 5 downstream dependencies.

Services impacted

5

Critical alerts

47

Avg latency

23ms

Throughput

640 Mbps

Findings

AI

Critical

Root cause: BGP peer failure on core-router-01

AI

BGP hold timer expired for peer 10.0.1.1 at 14:29 UTC. This is the earliest event in the cascade and directly caused OSPF adjacency loss. Recommend checking physical link to upstream provider and reviewing BGP keepalive settings.

Warning

Secondary: Possible exploit attempt during outage

AI

IPS flagged CVE-2024-3400 from 203.0.113.42 at 14:31 UTC — 2 minutes after the BGP failure. Attackers commonly probe during routing disruptions. Recommend blocking source IP and reviewing firewall logs for lateral movement.

Ask a follow-up, request deeper analysis, or suggest a hypothesis...

Summary

Components

(8)

Discuss

(3)

Private

Visible to everyone on this investigation

2 open

Command|Intel

6 minutes ago

I've flagged the CVE-2024-3400 exploit attempt as potentially related. Want me to dig deeper into the firewall logs for this source IP?

You

6 minutes ago

Yes — also check if that IP appears in any other event sources in the last 24h

Command|Intel

6 minutes ago

Checked — 203.0.113.42 appears in 3 additional firewall log entries over the past 12h, all port scans on 443/tcp. No lateral movement detected.

Reply... (use @ai)

You

6 minutes ago

Is there a redundant path through fw-edge-west? We should have a failover route configured.

Command|Intel

6 minutes ago

fw-edge-west is online and healthy, but no ECMP or failover route is configured for the BGP peer that failed. The OSPF adjacency to fw-edge-west is intact — this could be a quick mitigation path.

You

5 minutes ago

Confirmed with NOC — the upstream provider had a fibre cut at 14:28. ETA for repair is 2h.

Start a discussion... (or @ai to invoke AI)

Visible activity

Follow investigation status and the live activity stream.

Human direction

Steer, cancel and reopen investigations rather than accepting an unexplained conclusion.

Resilient operation

Retries, circuit breakers and deterministic rule fallback support continuity when an AI provider is unavailable.

A few good questions

Get clear
on the details.

Can operators verify AI findings?

Can AI change the monitoring configuration?

Does AI remember our environment?

Your next operational advantage

Put AI to work.
Leave the sprawl behind.

Bring your stack and a recent incident.
See what your team can simplify.