IT operations: review a host investigation with evidence
An IT host investigation should turn a specific operational question into reviewable commands and output. This walkthrough uses the existing sample demonstration and explains how to compare a real evaluation with manual work. Sample data does not establish production accuracy or customer time savings.
Evaluating this for your team? Discuss your use case, deployment boundary and success criteria in a technical briefing.
Book a technical briefingOpen the sample demonstration
Use the interactive demo or the relevant film in the existing use-case library. Select a sample host, read the question and inspect the displayed evidence. Treat the demonstration as an explanation of the workflow, not a live connection to a customer system.
Open the interactive demo · Watch the sample films
Review the evidence
Check that the selected host and question match the displayed commands. Identify what the output supports and what remains unknown. A plausible narrative without adequate evidence should not pass review.
Host investigations show the commands that ran, their exit codes and output, per host.
Test policy separately
In an agreed non-production evaluation, record the host policy, ask for an allowed read check and then test a denied or review-required action. Record the actual disposition and reviewer decision; do not infer enforcement from a sample UI.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Measure a real evaluation
Use a fixed question set and the same host conditions for the manual baseline and agent evaluation. Record elapsed time, evidence completeness, errors, reviewer acceptance and any policy violations. Report the sample size, model route, date and release alongside observations.
Questions buyers ask
Are these customer results?
No. The interactive demonstration and films use sample data. Publish customer results only after an approved, measured evaluation.
What should a reviewer inspect?
Inspect host scope, command, exit status and output before accepting a conclusion.
Host investigations show the commands that ran, their exit codes and output, per host.
Can a workflow make changes?
Execution depends on host policy. Agree a separate change test with a non-production host and the correct administrator.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Execution follows the configured host policy. A command can be approved, denied or referred for human review; individual approval depends on that policy.
Where to go next
All guidesBring one question of your own.