AI Assistant Setup

We set up an assistant around one team’s real work: their documents, their rules, the references they trust and the checks they need. Every answer starts from the right context instead of a blank page.

Discuss AI Assistant Setup

The eagle loads an incident response team’s log sources, runbooks and KQL reference into a team assistant, which then answers a question with a query that the eagle verifies.

Same question, same tool.

The blank assistant guesses. The set-up one answers the way your team works. Send them the same question.

Try asking

Without setup

You: Any legacy sign-ins this week?

Which logging platform do you use, and which table holds your sign-in data?

You: Sentinel.

Try this query:

AzureSignInLogs
| where TimeGenerated > ago(7d)
| where LegacyAuth == true
| summarize count() by User

You may need to adjust it.

What goes wrongNeither the table nor the column exists, so the query fails on line one.

With setup

You: Any legacy sign-ins this week?

Your sign-ins are in SigninLogs, in the soc-prod workspace.

Legacy clients, last 7 days, by account, client and IP:

SigninLogs
| where TimeGenerated > ago(7d)
| where ClientAppUsed in ("Exchange ActiveSync", "IMAP4", "POP3", "Authenticated SMTP", "Other clients")
| where ResultType == "0"
| summarize Attempts = count() by UserPrincipalName, ClientAppUsed, IPAddress
| order by Attempts desc

Check Successful sign-ins only (ResultType "0"). Remove that line to include blocked attempts.

Check Confirm the device with its owner before blocking (runbook, step 3).

Drew on

Select a source to see what it shaped.

Illustrative. The query is real KQL for Microsoft Sentinel’s SigninLogs table.

What we set up.

Five parts, configured together. Select one to see its job.

Question“Any legacy sign-ins this week?”

Incident response assistant

AnswerA working query, plus how to check it

Knowledge

The team’s own documents, so it knows your workspace instead of guessing.

In the incident response assistant

Log source inventory
Runbooks and playbooks
Escalation contacts

Without itIt invents a table called AzureSignInLogs.

How it runs.

One team at a time, in the assistant you already pay for.

Pick one team
One team, and the questions it asks every week.
Clean the sources
Stale documents fixed first, because it will trust them.
Build and test
On real questions, including attempts to make it guess or overshare.
Hand over
Someone on your side keeps it current.

What you receive

The configured assistant, in your existing tool
An instruction set your team can edit
A tested question library
An admin guide and a review date

Why have a security team do this?

“Connecting it to our documents sounds risky.”

We connect it read only, to named libraries, and never to mailboxes or HR by default.

How we do it

Before handover we try to trick it into oversharing, including with instructions hidden in a document.

Data questions firstWhat could leak is settled before switch-on.
Access set up properlyWe configure and test it ourselves.
Verified with your peopleSessions in plain English, not slide decks.

All Practical AI services

Got a team that asks the same questions every week?

Pick one team. We’ll set up its assistant around how it works.