Skip to content
ENVI
Request a demo

Platform overview Coordinator AI

Case coordination

Critical incidents, reasoned through on your own model.

Coordinator AI takes escalated incidents, reasons over them on a local LLM and runs multi-step response workflows. Every step that would touch a real system waits for people.

What it does

When a case reaches tier 3 — critical — an incident is opened and Coordinator AI takes it on. It works from BlueTeam AI’s case: the risk index, the recorded evidence and the linked cases.

Reasoning runs on a self-hosted, Ollama-compatible model by default, so incident details stay in your network. A cloud LLM is used only if you turn it on, and then only through Core’s server-side AI Gateway.

The response is a multi-step workflow. Each step that would change a real system becomes a proposal for Remediate AI’s action engine, and on a critical incident any action needs two approvers.

Key capabilities

  • Escalated incidents

    Tier 3 cases open an incident, with the case’s evidence and linked cases attached.

  • Local LLM reasoning

    A self-hosted, Ollama-compatible model by default; model choice stays with you.

  • Opt-in cloud LLM

    Only if you turn it on, through the capability-scoped AI Gateway, with the API key kept on the server.

  • Multi-step workflows

    Response plans with several steps, each one still passing the approval gate.

  • Two approvers on critical incidents

    Any action on a tier 3 incident needs two people to approve it.

  • Recorded decisions

    Every AI decision is recorded, can be reviewed and is counted against people’s verdicts.

How it works

  1. 01

    Escalate

    A tier 3 case opens an incident for Coordinator AI.

  2. 02

    Reason

    The model reasons over the case, its evidence and its linked cases.

  3. 03

    Plan

    A multi-step response is drafted; steps that change systems become proposals.

  4. 04

    Approve

    Two people approve any action before the action engine runs it.

The human approval gate

Coordinator AI does not act on systems by itself. Each action in a workflow passes the approval gate, and on a critical incident any action needs two approvers. A kill switch stops automated proposals.

Licence

Included in
Autonomous SOC licence (BlueTeam AI, Coordinator AI and Remediate AI together), Platform, Sovereign
Licence feature
module.blueteam_xdr

BlueTeam AI, Coordinator AI and Remediate AI are licensed together as the Autonomous SOC. Every licence includes the Core.

See pricing and licences

Where it stands today

Running and verified on simulated SIEM days and real Core events. It has not yet run on a customer’s live SIEM: each alert source starts in observe mode.

See how a critical incident is coordinated.

We walk through an incident end to end on your scenario, with the model running locally.

Request a demoPlatform overview