THEO can help you investigate security incidents and RMM device alerts directly from chat. It connects to your security stack and RMM to pull alert data, summarize what is happening, and — when routed through the ARGUS security engine — run deeper analysis. This article explains what THEO sees, what it can do, and where the limits are.
What THEO Can See in an Alert Context
When you ask THEO about an alert, it can access:
- Security alerts and incidents — list of active incidents, alert detail including source, severity, and affected entities
- Device detail — device name, operating system, online/offline status, and last check-in, read live from your RMM device records
- Device alerts — alerts cached from your RMM for the specific device
- Org context — a live snapshot of your org's open tickets, active incidents, device counts, and billing state
THEO does not have direct access to your SIEM log stream or raw event data beyond what is surfaced through the security and RMM integration endpoints.
Asking THEO About a Security Alert
You can ask THEO about an alert in plain language from any chat context. THEO's router sends security questions through the ARGUS security analysis engine automatically — there is no command to type.
Basic queries:
- "What security alerts are open right now?"
- "Tell me about incident INC-00412."
- "Which devices have critical alerts?"
Deeper investigation (ARGUS) — just ask; THEO picks the persona for you:
- "Investigate this IOC: 192.168.1.200 — what do we know?"
- "Triage this alert — is it a true positive or noise?"
- "What does this malware behavior pattern indicate?"
The ARGUS engine has five specialized personas that THEO routes to automatically based on your question: Scout (general triage), Forge (YARA/Sigma rules), Analyst (malware/binary), Phantom (red team/pentest context), and Sentinel (proactive monitoring). You do not need to specify which persona to use.
Asking THEO About an RMM Alert
For RMM device issues, THEO reads your RMM device records live — name, operating system, online/offline status and last check-in.
Examples:
- "Why is LAPTOP-042 showing a warning?"
- "Is the file server in Chicago healthy — when did it last check in?"
- "Which endpoints haven't checked in for 7 days?"
THEO reads device status and last check-in from your RMM device records and summarizes what it finds. It cannot return performance time-series — CPU, RAM, disk or network history for a device — because the platform's telemetry time-series pipeline is retired; it says so rather than presenting an empty result as a quiet device. It also cannot run commands on devices or push remediations through the RMM from chat — those actions require a runbook execution through Tier Zero.
Running a Security Investigation
For structured investigations, use the security investigation endpoint:
Ask: "Investigate a suspicious login from an unusual location for admin@contoso.com — it happened 20 minutes ago."
THEO gathers the available alert and device context, runs the ARGUS investigation tool, and returns a structured finding with severity, indicators, and a recommended next step. It may ask clarifying questions before running the analysis if the scope is ambiguous.
Limitations
- THEO cannot directly access raw SIEM log streams or unstructured event feeds
- THEO cannot push remediations to devices from chat (requires a runbook)
- Alert data shown in THEO is drawn from cached snapshots; very recent alerts (seconds old) may not yet be visible
- Security questions route through the ARGUS personas — if ARGUS is unavailable, THEO will say so and fall back to what it can answer from context
FAQ
Can THEO isolate a device from chat?
Not directly from chat. Device isolation is a runbook action that goes through the Tier Zero safety pipeline, which requires the appropriate mode and trust level to be configured. Ask THEO to run the relevant security runbook.
How does THEO know which ARGUS persona to use?
THEO's model router analyzes your question automatically. YARA/Sigma questions go to Forge, malware/binary analysis to Analyst, pentest/red team questions to Phantom, general triage to Scout. You do not specify a persona — just describe what you need.
Is the alert data THEO sees real-time?
Alert and device data is refreshed on a short cache cycle (the org context cache refreshes every 90 seconds). For very recent events, there may be a brief lag.