Key Concepts

CloudPeek has a small set of building blocks. Once you know these terms, the rest of the product makes sense. This page is a glossary you can come back to.

Incident

An incident is a single thing that needs attention, usually an alert from one of your security tools (a GuardDuty finding, a Defender alert, a Splunk detection) that CloudPeek has pulled in. Each incident has a severity (Critical → Informational), a priority (P1 → P4), a status, and, after triage, an AI-written summary, indicators, and a suggested plan.

Incidents move through a lifecycle: Pending → Triaging → Triage Complete → In Progress → Resolved → Closed (with Cancelled as an alternative end state). You manage them on the Incident Management screen.

Investigation

An investigation is an AI-assisted, chat-based deep dive into a question. You ask something in plain English; an AI agent gathers evidence from your connected tools, reasons across it, and reports back, all in a conversation thread you can steer. Investigations can be started by a human (from the Investigations screen) or proposed automatically as part of triage. See Investigations.

Incident vs. investigation: an incident is the thing that happened; an investigation is the act of looking into it. One incident may lead to one or more investigations.

Triage

Triage is the automatic first-pass analysis CloudPeek runs on every new incident, with no human action required. An AI pipeline reads the raw alert, converts it into structured data, pulls in context, scores it, picks a relevant runbook, and writes a summary plus a suggested investigation plan. By the time an analyst opens the incident, the groundwork is done. See Automatic Triage.

Follow-up action

A follow-up action is one step in the investigation plan that triage produced (for example "check whether this IP appears in firewall logs"). CloudPeek's background workers execute these automatically using read-only access to your tools, they gather facts but never change anything. See Follow-up Actions.

Runbook & Playbook

A runbook captures your team's standard procedure for a type of incident, written once and reused. During triage, the AI can select a relevant runbook to guide how it investigates. CloudPeek also supports related template types, playbooks (linked to specific tools), personas, and analytic rules (Sigma detection rules). In current versions these live in the Wiki. See Runbooks & Playbooks.

Tool / Integration

A tool (or integration) is a connection to an external security product, Splunk, OpenSearch, AWS, Azure/Defender, GitHub, VirusTotal, Shodan and more. Tools are how CloudPeek reads data and pulls in alerts. You add them in Settings → Tool Management. See Tools & Integrations.

Artifact

An artifact is a file or piece of content produced during your work, an uploaded log, a report the AI generated, an exported result. Artifacts are stored, searchable (including semantic search), and can be linked to the investigation or incident they belong to. See Artifacts.

The Wiki

The Wiki is CloudPeek's shared, living knowledge base, "shared memory for agents and analysts." It records what's known about every entity you encounter (a user, an IP address, a host, a CVE) as a page that both people and AI agents read and update. It's how knowledge stops living only in people's heads. See The Wiki.

Human-in-the-Loop (HITL)

Human-in-the-Loop is CloudPeek's approval system. You decide how much the AI may do on its own versus what needs a human's sign-off, from "run everything automatically" to "ask me before every action." There's also a Plan mode where the agent writes out its plan and waits for your approval before executing. See Human-in-the-Loop.

Tenant

A tenant is an isolated organisation/workspace. All data, incidents, investigations, tools, wiki pages, belongs to exactly one tenant, and tenants can't see each other's data. A single CloudPeek deployment can host many tenants, and a user can be granted access to more than one. The tenant selector in the top bar switches between tenants you can access.

Worker

A worker is a background process that does CloudPeek's automatic, behind-the-scenes work: pulling in alerts, running triage, executing follow-up actions, hunting for cross-incident patterns, and keeping the Wiki up to date. Workers run continuously so analysts always open pre-analysed incidents. See Background Workers.

Indicator of Compromise (IOC)

An IOC is a piece of evidence that something malicious may have happened, an IP address, a domain, a file hash, a username, a host. Triage extracts IOCs from each alert automatically and records them on the incident and in the Wiki.

Quick reference