AI agents for IT and security, each alert investigated and classified, with its evidence.
Your analysts start each alert, event or incident from the evidence. Duale AI reviews each one and returns the result in the format you set, with every finding linked to its source. One Task splits the work into focused branches and runs in the background.Alert triage, a severity and a recommended action for each new alert
Your analyst reads the reasoning and each finding's source, and your code has already opened the ticket.When it starts: your code starts one Task for each new alert.
How the Task splits it: three branches. The first gathers the evidence from your logs and security tools. The second reads the public advisories on the affected software. The third checks the recent changes on the affected machine. Each branch reaches your systems through Tools, and Model routing runs it on a model you enabled.
You get back: the category, the severity and the reasoning behind them, each piece of evidence with its source, and a recommended action. Your code opens the ticket.
Illustrative example: an alert on a finance team account at 02:14.
- Item
- Category
- Finding
- Suspected account takeover
- Source
- The three findings below
- Item
- Severity
- Finding
- High: the finance share holds payroll files
- Source
- Your asset inventory
- Item
- Sign-in
- Finding
- First sign-in to this account from a new country, at 02:14
- Source
- Identity provider log
- Item
- Activity
- Finding
- 3,200 files read on the finance share in six minutes
- Source
- File server audit log
- Item
- Device
- Finding
- The employee’s laptop was switched off at that time
- Source
- Endpoint protection console
- Item
- Recommended action
- Finding
- End the account’s sessions and reset its password; your code opened the ticket
- Source
- Your service desk
Your analysts decide: containment, closure or escalation.
Watch each reading and camera image, and act on your rules
Once each event is checked, your code takes the action, such as opening a ticket.When it starts: your code starts one Task for each event, or on the schedule you set. An event can be a new alert from a feed, a reading out of range or a new image. See how your code starts a Task.
How the Task splits it: focused branches read the event and compare it with earlier events and your rules. When a rule is met, they call your code, for example to open a ticket. For an image, your code adds it to a Library. An image-capable model you enabled then examines it.
You get back: for each event, a short status note against your rules, with what was found, its source, and the action your code took or proposes.
Illustrative example: two events in one evening.
- Event
- Server room B reads 31 °C, above your 27 °C limit
- What the Task found
- The temperature rose over 40 minutes; cooling unit 2 reports a fan fault; no maintenance is planned
- What your code did
- Opened an urgent ticket for facilities, with the readings and the fault
- Event
- The camera at the server room door sends a new image at 21:05
- What the Task found
- The door is propped open by a cart, with no one in view; the last badge entry was a contractor at 19:42
- What your code did
- Opened a ticket for the security desk, with the image and the badge entry
Your team decides: the fixes, and which actions your code may take on its own and which wait for a person.
Incident review, one timeline and one root cause, with evidence
Walk into the post-incident review with the causes set aside and why, and a suggested owner for each action.You hand over: “Build the timeline and find the root cause of the customer portal outage between 14:00 and 15:00, for Friday’s review.”
How the Task splits it: one branch per source, such as your monitoring data, your change records and the incident tickets. The Task merges what they find into one timeline. A review branch then tests each candidate cause against that evidence and sets aside any cause it does not support.
You get back: the timeline, the root cause with its evidence, the causes set aside and why, and the actions to take with a suggested owner for each.
Illustrative example: a 47-minute outage of the customer portal, ready for Friday’s review.
- Time
- 14:02
- Event
- Release 4.18 of the customer portal goes live
- Source
- Deployment history
- Time
- 14:09
- Event
- Database connections reach their limit; 38% of requests fail
- Source
- Monitoring data
- Time
- 14:21
- Event
- Incident opened; the first responder restarts the portal
- Source
- Incident ticket
- Time
- 14:49
- Event
- Release 4.18 rolled back; failed requests return to normal
- Source
- Deployment history, monitoring data
- Time
- Root cause
- Event
- Release 4.18 cut the database connection pool from 50 to 10
- Source
- Change record for release 4.18
- Time
- Set aside
- Event
- Network fault: no packet loss recorded during the incident
- Source
- Monitoring data
Your team decides: which actions to take, who owns each one, and what to share with the teams affected.
The capabilities behind each investigation
Each one is set up once on the Platform and serves your other use cases too.Tools
Every change in your systems goes through your own code, from opening a ticket to ending a session. Web research reads the public advisories.
Libraries
Keep your asset inventory, architecture documents and the images your code adds in Libraries. Each Task cites the passage or the image it used.
Identity and access
Your security agent reaches only the systems you grant it, and other teams’ agents never reach its findings.
Usage analytics
Follow each alert’s Task step by step in the Dashboard Task view, with each branch’s Tools and model cost.
Before your first investigation
The facts your finance and procurement colleagues check.One fixed price per Task
A standard Task costs €0.10 and a fast Task €0.20, excluding VAT, whatever the number of branches or the duration. See pricing
Your providers, your contracts
Your model providers bill you directly for inference.
Your choice of hosting
Use the managed service, hosted in the European Union, or run the Platform in your own infrastructure.
Encrypted storage
All stored data is encrypted, from Library files to database backups.
Unlimited agents
Add agents as your teams and use cases grow.
Your content remains yours
Duale AI does not reuse your content to train a model. See subprocessors
IT and security questions
Yes. Each investigation compares the new alert with your post-incident reviews and cites the past case that matches. See how Libraries keep your reference files, or read what a Task recalls from earlier Tasks.
Yes. Each alert comes back in your own categories and severity levels, and each recommended action names the runbook step behind it. See how Libraries keep your runbooks.
The ones you connect, such as your SIEM, your endpoint protection and your service desk. See how Tools connect your systems.
Yes. The review reads the repositories and logs your own code shares with it, and calculates figures from them, such as the error rate before and after each release. See how Tools reach your private systems.