AI Chat
Ask your fleet anything
Query events, manage rules, and investigate issues in plain English. Ask once and get a complete answer, backed by deep links into Workshop.
Investigation
One question, one answer
Real investigations cross events, hosts, rules, packages, apps, and the audit log. AI Chat answers them once, with deep links back into the Workshop pages that back the answer.
-
One question, one complete answer
AI Chat fans out across the Workshop API, combines results, and answers without the user pivoting between pages.
-
Deep links with filters pre-applied
Every answer links back to the Workshop page that backs it, with the right host, time window, or tag already selected.
-
Follow-ups keep the prior context
Conversations stay coherent across turns. You can refine, drill in, and pivot without re-stating the question.
-
Anyone on the team can run the investigation
Plain English replaces tribal knowledge of where data lives. Junior responders ask the same question a senior would.
Sample prompts
Ask anything
Three common investigations, one question each. These ship as sample prompts in the Workshop UI.
"Which production hosts had the most blocked events this week?"
A ranked table of hosts, with deep links into the events page pre-filtered by host and time window.
"How many hosts are still on Santa 2024.8?"
Version counts across the fleet, with a deep link into the hosts page filtered to the out-of-date group.
"Who changed the global allowlist last week?"
A list of rule edits with who made them and when, linked to the audit page with the same filters applied.
Security model
Permissions, not prompts
AI Chat inherits your permissions. Every tool call routes through the same authentication and authorization middleware that protects Workshop's REST and gRPC APIs. There is no prompt-based override.
Tools
What it can do
Out of the box, AI Chat knows every Workshop API operation, the full Workshop and Santa documentation, and how to link back to the right internal report.
Query your data
Events, hosts, rules, packages, apps, and audit logs are all queryable in plain English. Filter by tag, host, time window, publisher, or hash, and cross-reference across resources in one question.
Manage rules
Create, update, and delete execution rules, package rules, and file access policies through conversation. Edits hit the same API as the dashboard, with role-based access enforced at the middleware.
Investigate your fleet
Host status, version, and config queries answered without navigating between pages. Diff a host's config against tags or global defaults, or pull blocked-event history per host in one turn.
Built-in documentation
AI Chat ships with the full Workshop and Santa documentation loaded. Ask about CEL syntax, rule precedence, file access authorization, or Santa client modes and get sourced answers, not hallucinations.
Deep links
Responses include links that jump directly to the relevant Workshop page with filters already applied. Hosts, events, rules, apps, audit logs, every internal report has a generator.
Audit trail queries
Query the audit log in plain English. AI Chat's own activity is logged there too, tagged with the conversation ID, so there's one chain of custody across UI, API, and chat.
Configuration
Flexible configuration
AI Chat plugs into whatever AI provider and secrets stack your org already uses, with admin controls over what it can touch.
Read-only by default
Write operations are disabled until an admin explicitly enables read-write mode. Out of the box, AI Chat can query but not modify, with per-role write permissions and a single org-wide kill switch.
Permission-based access
Tools are filtered by your role before the model sees them. If you can't delete rules in the UI, the delete-rule tool isn't on AI Chat's toolbelt for you. Same middleware as Workshop's REST and gRPC APIs.
Bring your own key
Anthropic, OpenAI, and Google are all supported. Use your existing provider contract, your own usage quotas, and route long-context work to whichever model fits the job.
Secrets storage
Store provider keys in AWS Secrets Manager or GCP Secret Manager instead of Workshop's database. Keys never leave your cloud boundary in plaintext, and you rotate at the secret manager.
Full audit trail
Every tool call is written to the audit log with your identity, the conversation ID, and the tool arguments. Queryable from the audit page, and exportable to Splunk, CrowdStrike, or any SIEM.
Audit
Every conversation has a paper trail
Every tool call AI Chat makes is stamped with your identity and the conversation ID, then written to the same audit log as every other Workshop action. Investigations are reproducible and reviewable, including the ones the model ran for you.
-
Identity-stamped tool calls
Every action AI Chat takes on your behalf is logged with your user identity, the conversation ID, and the full tool arguments.
-
One audit trail across surfaces
AI Chat writes show up in the same audit log as UI and API changes. Compliance reviewers see one chain of custody, not three.
-
Reproducible investigations
Replay any conversation from the audit page. The same conversation ID ties together every tool call the model made on your behalf.
AI Chat is part of Workshop
Pair AI Chat with the rest of the platform to ask questions of the whole stack.