AI Assistant

You must join the New AI Features Early Access Program to use this feature.

You must be an Admin or Super Admin to use this feature.

The AI assistant is a generative AI-powered tool that lets you investigate security issues using natural language prompts.

Underpinned by the Sophos Data Lake and AI-driven analytics, the AI Assistant makes security analysis more effective.

You can use it to investigate cases as follows:

Select predefined prompts. These can generate a case summary, get details of activity on devices, show actions you can take, and more.
Enter your own prompts.

You can add the AI Assistant's responses to your case notebook.

Get started with AI Assistant

Go to Threat Analysis Center > Cases.
In the Cases list, click the Case ID of the case you want to investigate.
On the Case Details page, in the main pane on the right, select the AI Assistant tab.
In the AI Assistant tab, enter a prompt in one of the following ways:
- Click one of the prompts on the blue cards to add it to the search bar. You can edit the prompt text in the search bar to suit your needs, if you want to.
  
  To see more predefined prompts, enter a forward slash / in the search bar.
- Enter your own prompt in the search bar.
Click Send.
Wait for a response. A dotted progress indicator is shown beside the prompt.

When the response is ready, the AI Assistant shows it.

The AI Assistant can write a summary of your case.

You can request this summary in two places in the case details pages:

On the Overview tab, in the Case summary pane, click the AI icon. When the summary is shown, click Insert to add it to the pane.
On the AI Assistant tab, click the predefined Summarize the case prompt.

You can save the AI Assistant's responses in your case's Notebook tab.

To save a single response, click the plus sign icon under that response.

In the AI Assistant tab, click the three dots icon next to the Send button.
Select Select responses.

Checkboxes are now shown next to each response on the tab.
Select the checkbox next to each AI response you want to add to the notebook.
Click Add to case.

The responses are added to the Notebook tab.

You can delete all the AI Assistant's responses in the current thread and restart your investigation.

Other Sophos Central admins can use the AI Assistant to investigate the same case, but only you can see the thread you started.

However, if you add responses to the Notebook tab, other admins with access to this case can see them.