Respond to every signal at machine speed.
Don't settle for a "Tier 1 Analyst Agent." Create any response agent in natural language. Tailor it to your team's workflows and processes.
- 1In
Google Workspace, list its scopes and grants - 2Check the publisher's domain in
VirusTotal - 3Trace what the token read and changed
- 4Ask
#security before revoking it everywhere
Automate response from any alert source
Agents respond to any signal across your entire tool stack, reducing MTTR and manual investigation. Enrich tickets, investigate & triage alerts, conduct offboarding reviews, and so much more.
CrowdStrike Falcon detectionsEndpoint Alert Responder
Okta Identity ProtectionIdentity Alert Responder
GCP Security Command CenterGCP Alert Responder
Jira security issuesInsider Risk Responder
Take full control over agent behavior
Fully control the prompt, model choice, tools, and output format to match your workflows and preferences.
“Other AI SOC tools felt pretty black box. Cotool gives us control over the system prompt, how we tune it, what it connects to. I like being that close to the configuration of the agent.”
Triage endpoint alerts using CrowdStrike Falcon alert and behavior data as the source of truth. Reconstruct the full process tree before judging any single event.
- -Confirmed credential theft or C2 escalates immediately with the behavior chain preserved.
- -Prepare containment (network quarantine, session revocation) for approval; never auto-isolate developer endpoints without human sign-off.
- -For benign developer tooling, propose a scoped exclusion instead of a broad suppression.
Query SIEM LogsRevoke Okta User SessionsList AlertsTake Action on HostsRetrieve Okta User
Create FireHydrant IncidentCotool meets you where you're already productive.
Call agents from anywhere — API, webhook, or cron. Native hooks into tools like slack and ticketing systems, plus an API for everything else.
SlackJira
Linear
Scale Response without sacrificing control
See how teams use Cotool to scale human judgement with tokens rather than more headcount
Book a demoExtended Features
Evaluation & Monitoring is First Class
Cotool’s evaluation harness automatically measures every agent run so you can track agent performance over time. Agent version control keeps the lineage clear.
Generate rich structured outputs
Configure agents to produce standard or templated outputs from every agent run for easy verification. Quickly understand agent decisions and reasoning with outputs rendered inline.
- Actor
- mbolton@menlolabs.com
- Changed
- WEBHOOK_URL, WEBHOOK_VERSION
- Approval
- #platform-ops
- Tuning
Cotool/menlo#2
Orchestrate multi-agent workflows
Tackle even the most complex tasks by composing re-usable specialized sub-agents.
Suspicious binary accessing browser cookies and KeychainCS-884120InvestigatorInvestigatorInvestigatorAgents that improve over time
Cotool reflects on low performing runs, producing one click suggestions with reasoning and citations to address them up front.
The run on the marketing assets bucket scored 88: one redundant audit query before checking the public-content allowlist.
Public read ACL added to marketing assets bucket · 88“You can encode your own expertise into Cotool. It runs your playbooks as if you were doing it yourself — just faster and around the clock.”
