Phase 03 · AI triage
AI triage and root cause
The Agent starts on the alerts your current tools already fire, so value lands before anything moves and nothing is ripped out.
01How it works
Every alert, worked
Agents work each alert as it fires, one on security triage and one on root cause, and they hunt the history for what nobody thought to alert on.
Findings land in the ticket your service desk already uses. By then the queue runs both ways: a request for a new source or a new alert, and a fix an agent proposes off its own finding, both arrive as pull requests rather than as console work. Remediation is always a proposal a person reviews, never an unattended change.
What you own after: playbooks written around your environment that get sharper with every investigation, and one agent pointed at security triage while another works root cause.
02The half nobody sells
Why the platform version stops short
A platform's assistant lives inside its own console, reasons about what that console holds, and stops at its edge.
The same idea over an estate you hold as code reaches the collection layer, the destinations, the Lake and the infrastructure underneath, because every part of it is readable. The Agent follows the same trace ID your APM raised into everything the collector kept around it. That reach is what the phases before this one exist to build, and it cannot be bought as a module.
From outside nothing moved. Same sources, same destinations, same service desk. In between sits a layer you own, where the models are yours and the runbooks are your team's.
03Questions
Asked about the Agent
Does the Agent replace our SOC?
No. The Agent starts on the alerts your current tools already fire, so nothing is ripped out and value lands before anything moves. Findings land in the ticket your service desk already uses. It is triage without headcount on tools you already pay for, working the queue your people never get to.
Whose models does it run?
Yours to choose. The model behind triage is a configuration decision, frontier or open weight, in your cloud, and swappable later without rebuilding anything, because every model reads the same foundation: the enriched, partitioned Lake built in Phase 01.
What do we own afterwards?
Playbooks written around your environment that get sharper with every investigation, and the agents themselves, running in your own account on your own runbooks. One points at security triage while another works root cause. None of it lives inside a vendor console.
Why does this phase come last?
Because the Agent is only as good as the data it can reach. Phase 01 makes the history clean, enriched, cheap to keep, and yours. Without that foundation an agent reads one console and stops at its edge, which is exactly the version the platform vendors sell.
Start with the review
You share your diagrams, we review them with you, and you leave with your version of the Logmetry Blueprint drawn on your stack. No system access, no obligation.