Quickstart

This guide takes you from your first login to a working setup where CloudPeek is pulling in alerts, triaging them automatically, and helping you investigate. Allow about 15 minutes.

Step 1, Sign in

Open your CloudPeek URL and sign in with your email and password on the Sign in screen. If your organisation has single sign-on, use the SSO button instead. Forgot your password? Use Forgot password?, if self-service reset is enabled, you'll get a verification code by email.

After signing in you land on the Dashboard (the "Operations" wall), which shows live incident, triage and agent activity. On a brand-new instance most of it will be empty, that's what the next steps fix.

Step 2, Configure an AI model provider

CloudPeek's AI features (triage, investigations, the "Ask CloudPeek" panel) need a language model to run. Set one up first.

1. Open Settings (gear icon, bottom of the left sidebar) → /admin/settings.
2. Click the Model Providers card.
3. Add a provider and credentials (for example an AWS Bedrock or an LLM-gateway endpoint your organisation uses), then choose a default chat model.

If no provider is configured you'll see a banner on the Dashboard and the investigation screens will say "Set up an LLM provider to start investigating."

Step 3, Connect your first tool

Tools are the security products CloudPeek reads from and (optionally) pulls alerts from.

1. Go to Settings → Tool Management, or open /tools directly.
2. Click Add Tool (top-right) to open the tool picker at /tools/new.
3. Pick a provider: for example Splunk, OpenSearch, GitHub, VirusTotal, or the AWS / Azure bundles.
4. Acknowledge the credential-handling notice, then fill in the connection fields (host, token, API key, etc.).
5. Click Test Connection to confirm CloudPeek can reach the tool, then Create Configuration.

Your tool now appears as a card on the Tool Management page. See Tools & Integrations for the full provider list and bundle details.

Step 4, Turn on automatic alert intake (optional but recommended)

If your tool can be a source of alerts (for example Trend Micro Vision One or AWS Security Hub), turn it into an incident source so CloudPeek pulls alerts in automatically:

1. Edit the tool configuration.
2. Switch on Enable as Incident Source.
3. Set a Polling Schedule (a cron expression: the default */15 * * * * polls every 15 minutes), and optionally the alert types and time range.
4. Save.

From now on, CloudPeek checks that tool on schedule, creates an incident for each new alert, and queues it for automatic triage. See Automatic Triage for what happens next.

Step 5, Watch automatic triage happen

Open Incidents from the left sidebar (/operations/incidents). New alerts arrive with status Triaging, and within a minute or two move to Triage Complete. Open one and you'll see an AI-written summary, key details, indicators of compromise (IOCs), a timeline, and a suggested investigation plan, all produced without anyone pressing a button.

You decide what happens next using the Review Outcome dropdown: Close (no action needed), Escalate (needs investigation), or Reject (the triage was wrong, you give a reason).

Step 6, Run your first investigation

Investigations are AI-assisted, chat-based deep dives.

1. Click Investigations in the sidebar, then New Investigation (/investigations/new).
2. Type a question: for example "Investigate suspicious logins for user jdoe in the last 24 hours", or pick one of the example prompts.
3. Press send. CloudPeek opens the investigation workspace and the AI agent starts gathering data from your connected tools, streaming its actions into the Action Log.
4. Ask follow-up questions in the same thread. When you're done, use Export Results.

Step 7, Stay in control with approval gates

By default, external tool calls require your approval. In an investigation, the approval control in the chat input lets you choose how much autonomy to grant:

• No Approvals: everything runs automatically.
• Approve External Writes: only actions that change an external system need approval.
• Approve All External: every external tool call needs approval (the default).
• Approve All: every single tool call needs your sign-off.

When the agent wants to run a gated action, you'll see Approve / Reject buttons inline. Read more in Human-in-the-Loop.

You're up and running

Here's what to explore next:

• Navigating the App: a tour of the whole interface.
• The Wiki: capture what you learn so the next investigation is faster.
• Runbooks & Playbooks: encode your team's standard procedures.
• Admin & Settings: users, tenants, audit logs and tuning.