Platform · AI Mode
Work that required a specialist becomes work any analyst can perform in seconds.
AI Mode is the productivity unlock for a security team. It runs across every layer of the platform, on every page of the product, including inside every case. No query language, no console archaeology. Ask, and it investigates, builds and explains, grounded in your actual data.
Who this is for
Every analyst on the team, at every skill level. This is the layer that removes the hiring bottleneck.
Perform investigations
"Was this IP seen anywhere before Tuesday's alert?" AI Mode translates the question, queries across identity, cloud, endpoint and SaaS, iterates until it has an answer, and returns an analytical conclusion rather than a raw table. The SQL is there when you want to check the work.
Run threat hunts
Kick off a hunt from a hypothesis stated in natural language. It runs across every connected source, shows its work, and lands the findings in the same governed catalog your team already uses.
Create new detections in natural language
Describe the behavior. AI Mode drafts the rule, validates it against your history, shows precision against past cases, and deploys on your approval. No SPL, no KQL, no other query language required. A two-week detection cycle becomes a conversation.
"We now use Artemis to generate working detections and find the correlations across log sources automatically. Now if we want to detect something, we just ask the agent in plain English: help us write a detector to find this."
Zehuan Li, Security Software Engineer 
Frequently asked questions
Yes. Every answer carries the reasoning chain and the queries run, and the SQL is available on request.
No. Query languages remain available for anyone who prefers them, but nothing requires one.
Yes. Organizations author their own AI skills: versioned playbooks analysts invoke from the composer.