The Wiki

The Wiki is CloudPeek's institutional knowledge base, described in the product as "shared memory for agents and analysts, every entity, every change." It's where the team's knowledge about your environment lives, so it stops disappearing into people's heads and chat threads.

Unusually, the Wiki is read and written by both people and the AI. When an investigation turns up something about an IP address or a user, that knowledge is captured as a Wiki page, and the next time anyone (or any agent) encounters that entity, they start from what's already known.

Open it from the sidebar → Wiki (/wiki).

Why a Wiki, not just notes

Traditional security teams lose knowledge constantly: the analyst who knew that 10.0.4.12 is a noisy-but-benign scanner leaves, and the next person re-investigates it from scratch. CloudPeek's Wiki turns that tacit knowledge into a durable, shared asset:

• It's shared: everyone on the tenant sees the same knowledge.
• It's living: it's updated automatically as investigations happen (see auto-indexing below).
• It's connected: entities link to each other, so you can follow relationships.
• It's used by the AI: agents read it for context, so your accumulated knowledge makes every future investigation smarter.

How the Wiki is organised

The Wiki is a graph of pages, where each page is one entity. Every page has a type and a key, written as type:key, for example:

• user:jdoe
• ip:1.2.3.4
• host:web-prod-01
• cve:CVE-2024-1234
• runbook:phishing-response

Each page contains:

• Sections: the actual knowledge, written in Markdown (e.g. Summary, Timeline, IOCs, Remediation).
• Tags: labels for grouping and filtering.
• Backlinks: other pages that reference this one.
• A graph mini-map showing how this entity connects to others.

Pages can reference each other with [[type:key]] links, which is how the knowledge graph is built.

Finding knowledge

On the Wiki home you can:

• Search with the box ("Search wiki (quotes for phrases, -word to exclude)…"). It does full-text search across section bodies and shows snippets. Use "quoted phrases" for exact matches and -word to exclude a term.
• Filter by type using the colour-coded entity-type chips.
• Filter by tag from the tag cloud.
• Browse a feed of recent changes, or use the Browse sidebar to list entity types with counts.

There's also a dedicated search route (/wiki/search) that supports shareable links with the query, types and tags baked in.

Reading a page

Open any entity (/wiki/{type}/{key}) to see its sections as cards, with tags, backlinks and the graph mini-map in the side rail. If a page was created automatically but not yet filled in, you'll see a prompt: "This page was auto-stubbed. Add a Summary section to start documenting what you know."

Adding and editing knowledge

To add knowledge to an entity:

1. Open (or search for) the entity page.
2. Click Add section.
3. Give the section a name (e.g. Timeline, IOCs, Remediation).
4. Write the body in Markdown. Reference other entities with [[type:key]].
5. Add a commit message explaining why you're adding this.
6. Click Create section.

Existing sections are edited in place. Every change is versioned, you can view the revision history (/wiki/{type}/{key}/history) and see diffs between versions, and revert if needed.

Managing entity types

Administrators can define the kinds of entities the Wiki tracks at /wiki/settings/entity-types: each type has a name, a display label, an icon and a colour.

Ask CloudPeek

The Ask CloudPeek panel (the button in the top bar) is the Wiki's question-answering feature. When you're on an entity page, the panel scopes itself to that entity, the prompt becomes "Ask about {entity}…" and you can ask questions like "has this IP appeared in any incidents this month?" The panel opens beside the page so you can read and ask at once.

Under the hood, asking a question spins up an investigation scoped to that entity, using the same AI engine. It needs an AI model provider configured ("Ask CloudPeek needs an LLM provider to answer questions").

How the Wiki stays up to date

You don't have to maintain the Wiki by hand. As triage and investigations run, CloudPeek notices the entities involved (IPs, hosts, users, file hashes, CVEs) and a background wiki auto-indexer turns those observations into page updates, one AI-written update per entity. So the knowledge base grows as a natural by-product of doing the work. See Background Workers for how this runs.

Runbooks live in the Wiki

In current versions, runbooks and playbooks are Wiki entities too (types like runbook: and playbook:). That means your standard procedures sit alongside, and link to, the knowledge they relate to.

Related

• Investigations: the engine behind "Ask CloudPeek."
• Background Workers: how the Wiki auto-updates.
• Wiki API: read and write Wiki content programmatically.