Guides
Day-to-day guides for working with Hal, how triage keeps your inbox quiet, what an alert contains, how to ask Hal questions, and how to quiet a noisy source.
How Triage Works
Hal watches every client every few minutes.
OpenNoise Tuning and Silencing
Mute a source under maintenance, tell Hal what is normal for a client, and let his night shift propose the whitelist.
OpenReading a Report
When Hal escalates something, you don’t get a raw log line, you get an analyst’s write-up.
OpenUsing Hal in Chat
Hal runs in two modes at once.
OpenHal's night shift
Every night Hal reviews two weeks of his own conclusions, finds the patterns he keeps re-investigating to the same benign answer, and drafts whitelist recommendations. You accept or decline in chat. The goal is simple: stop paying for the same conclusion twice.
OpenSentry
A standing read of a client's higher-risk people: executives, finance staff, administrators. Hal reads every event that names them each cycle and escalates what does not fit what is known about them.
OpenWatches
Post-incident monitoring you open in chat. Hal re-checks a named account or pattern on a schedule for a bounded time, and a hit is an alert like any other: a report on Events, emailed under your threshold.
OpenControlling AI spend
Four settings decide most of what Hal costs you in AI usage: how often triage cycles run, which model investigates, how Sigma matches are handled, and how much recurring noise you've whitelisted. What each one does, what it trades off, and where to read the result.
OpenBilling
What Settings → Billing shows, how each invoice comes from a number already on that page, the notices before the evaluation ends and when a payment fails, and what happens while Hal is paused for an unpaid invoice.
OpenSee what Hal surfaces on your own clients.
No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.
- 01You ask us your questions. No deck, no demo dataset.
- 02You sign a short evaluation agreement, and we stand up your own instance.
- 03You connect one tenant from your own admin console. Hal watches it for 14 days.
- 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.