AI security & operations for MSPs

Events, and the context that makes sense of them

Hal reads two kinds of data together. Events without context are noise; context without events is a static inventory. He reads both, which is why an alert arrives as a conclusion rather than a question.

Log sources: the events

Cloud API Microsoft 365 Unified audit log, directory, risk detections. Cloud API Google Workspace Admin reports, login and security events. Cloud API Entra ID Sign-in logs, risky sign-ins, directory changes. Log shipper Windows endpoints Windows event logs via a userspace Fluent Bit forwarder. No kernel driver. Syslog Network devices Routers, firewalls and switches, by syslog to a collector on the site's LAN. EDR alerts CrowdStrike Falcon Falcon detections and scored leads, correlated with sign-ins. Helpdesk Zendesk Every ticket update, and Hal's answer on the ticket when an agent asks. Credential store 1Password Sign-ins, item usage and account changes, from each client's account and your own.

Your MSP systems: the context

RMM NinjaOne Managed endpoints, warranty, last-seen. PSA ConnectWise PSA Tickets, boards, SLA, client records. Documentation Hudu Runbooks, network maps, asset records. Documentation IT Glue Flexible assets, configurations, documentation. Network Meraki Topology, WAN IPs, site-to-site VPN peers.

Delivery: where Hal reports

Chat Slack Escalations, the morning digest and answers, in your team's channel. Alerts Microsoft Teams Escalations, the morning digest and health changes, as cards in your channel.

Why both halves are required

A sign-in from an unfamiliar country is an event. Whether it matters depends on whether that device is managed, whether there is an open ticket about the user's travel, and whether the documentation says that client has staff abroad.

A SIEM that only has the event has to send it to you and let you go and find out. Hal has already read the RMM, the PSA and the documentation, so most of those events are answered before anyone is interrupted. The ones that do reach you arrive with that context already in them.

Technical onboarding is in the docs

See what Hal surfaces on your own clients.

No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.

Book a walkthrough Pricing
  1. 01You ask us your questions. No deck, no demo dataset.
  2. 02You sign a short evaluation agreement, and we stand up your own instance.
  3. 03You connect one tenant from your own admin console. Hal watches it for 14 days.
  4. 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.