In the web console.
Ask about the systems and activity you are examining. Follow the work, inspect figures and supporting evidence, and continue the conversation.
Recorded Prophet Agent session
Accelerated excerpt. No audio.
Prophet Agent
Ask Prophet
anything.
An expert agent for your network and host telemetry.
Ask a question or give Prophet an investigative objective. It searches the available telemetry, follows relationships, and tests explanations against the evidence.
Access, execution,
and communication.
Investigated together.
Prophet collects network and host telemetry together. Process attribution connects observed communication to execution. Authentication and session records provide evidence about how that execution began.
Access
Account, login and session
Execution
Parent process, command and executed process
Communication
Connection, service and destination
Follow the evidence backward toward an action’s origin and forward through the activity that followed. Process and login detail depend on the host telemetry your deployment collects.
Give Prophet the
investigative work.
You do not need to know which log format contains the answer or write each query yourself. Prophet searches host telemetry by meaning, examines network behavior, and follows process relationships as the investigation develops.
What initiated this outbound connection?
What else executed in the same login session?
Which processes use this database, and how do they communicate?
Which destinations did this process and its descendants reach?
A finding can open another question. Prophet can compare explanations, pursue related activity, and check its conclusions against further evidence.
Work alongside it.
Inspect what it finds.
Follow the investigation as it develops. Provide additional information, redirect the work, or ask a follow-up. The explanation and its supporting evidence remain available to examine.
In the CLI.
Work with the same agent through Prophet CLI. See the queries it runs, the evidence it returns, and the explanation as it develops.
One conversation. Continue in the console or CLI without starting the investigation again.
The evidence stays
part of the answer.
Prophet distinguishes what was observed, what was inferred, and what the available telemetry could not establish. You can inspect the supporting work and decide where to go next.
Available detail depends on collection coverage and retained telemetry. Evidence gaps and unresolved questions remain part of the investigation.
Bring your question.
Deploy Prophet Nodes where you need visibility. Prophet operates the telemetry and investigation infrastructure behind them.