Skip to main content
The Chat interface provides an interactive copilot experience for ad-hoc investigations and exploratory work. Chat is helpful for ad-hoc investigations or exploring your environment. It is also a helpful starting point to build agents

​
How Chat Works

1

Start Conversation

Navigate to Chat, select relevant tools/integrations (by default, all tools are selected)
2

Ask Questions

Natural language queries about your environment
3

Chat Investigates

Calls tools, gathers data, analyzes
4

Iterative Refinement

Follow-up questions, drill deeper
5

(Optional) Create Agent

Convert successful chat to reusable agent

​
Use Cases

Investigations

Explore alerts, users, indicators

Research

Gather information across systems

Troubleshooting

Debug issues with AI assistance

Report Generation

Create formatted reports from conversations

Agent Creation

Convert successful chat to reusable agent

​
Example Conversation

You: Investigate user john@example.com - check for suspicious activity Cotool Chat: 
Searching across systems...

✓ Okta: Found user, last login 2 hours ago from 192.168.1.50
✓ AWS: User has admin access to production
✓ Splunk: 0 security alerts in past 24h
✓ SentinelOne: No endpoint alerts for john's devices

Summary: No suspicious activity detected. Normal activity pattern.
You: Check that IP address 192.168.1.50 Cotool Chat: 
✓ VirusTotal: IP clean (0/90 vendors flagged)
✓ Internal records: IP belongs to HQ office network
✓ Geolocation: San Francisco, CA (matches office location)

Verdict: Legitimate office IP ✅

​
Features

File Attachments: Upload logs, screenshots, documents to chat for analysis Create Agent: Convert successful chat to reusable agent

File Attachments

Learn about uploading files to chat