Ask
Ask one question across every system, and see how it was answered.
Ask in plain English and get one answer drawn from footage, badge logs, sign-ins, servers and spend. Each answer shows how the question was read, which systems it asked, the queries it ran and what policy left out. The engine has no access of its own: it reads only what the person asking may read.
The advantages
The outcomes this product is built around.
One question, every pillar
The question is split into a request to each system that holds part of the answer, and the parts are joined on people, resources, time and place.
An answer you can check
Every answer carries its plan: the queries that ran and the sources they read, so a conclusion can be traced rather than taken on trust.
It never sees more than you
Each part of the question is authorized as the person asking before it runs. The engine holds no privileges of its own to fall back on.
Withheld is not the same as none
When policy keeps part of an answer from you, the answer says what was left out and why, instead of reporting zero.
- worked cross-pillar questions from the specification, all answered correctly
- 7
- business entities defined in the semantic layer
- 8
- privileges held by the engine itself
- 0
See it in the console
Real screens from the product, not mock-ups.
Ask it
A question about the north gate, answered with how it was read and the query it generated.
What policy left out
A cross-pillar question where the footage leg needed a purpose, and the answer says so.
The query behind the answer
Exactly what was sent to each pillar.
Metrics that agree
Governed metrics with their certification status and version.
How it fits together
What happens between your request and a running resource.
A question is parsed and resolved against the semantic layer. The engine asks each pillar that holds part of the answer for a plan, authorized as the asker, runs the independent legs in parallel and joins them. The answer comes back with its plan and with anything policy excluded.
- A question: console · API · SDK (You)
- Answer and plan: queries · sources · exclusions (You)
- Understanding: semantic layer · synonyms (The platform)
- A leg per pillar: authorized as you (The platform)
- Join: person · resource · time · place (The platform)
- Video: detections and events (Your pillars)
- Identity and access: sign-ins · badges (Your pillars)
- Data and cloud: tables · telemetry (Your pillars)
- A question to Understanding
- Understanding to A leg per pillar
- A leg per pillar to Video
- A leg per pillar to Identity and access
- A leg per pillar to Data and cloud
- A leg per pillar to Join
- Join to Answer and plan
Who it is for
The teams and situations this product was built for.
Security leads
Questions like “who entered the server room without badging in” that span cameras and access logs.
One answer joining footage to the badge record, with the queries behind it and the purpose it was asked for.
Operations managers
Numbers that mean the same thing on every dashboard and in every answer.
Certified, versioned metrics computed by one definition wherever they appear.
Audit and compliance
To know how an answer was reached and whether anyone saw more than they should.
Plans, sources and exclusions recorded with every answer, under the asker’s own permissions.
What it does
The core capabilities, live in the product today.
Questions in plain language
A question is parsed into entities, constraints, a time window and a scope, resolved against the semantic layer, with synonyms for your own vocabulary.
The parser reports what it understood and what it did not use, so a dropped word is visible rather than silently ignored. Business terms map to entities through the semantic layer, and synonyms let “badge ins” and “door entries” mean the same thing.
Joins across pillars
Independent legs run in parallel against each pillar, then join on principal, resource, time and location, including “without” questions.
The engine picks the pillars that hold the answer and asks each one for a plan. “Without badging in” becomes an anti-join between footage and the access log, with the time tolerance stated in the answer.
Entitlements on every leg
Each leg is authorized at plan time as the asker. What was excluded, and the policy that excluded it, is part of the answer.
A leg the asker may not read is not run at all, and the answer names it. A deep-archive footage leg without a stated purpose is one example: the answer says purpose was required instead of reporting nobody.
A semantic layer across the platform
Entities such as customer, site, asset, employee, vehicle, camera, server and incident, their relationships, and mappings from tables, detections, IAM events and cloud telemetry.
The semantic layer is where “a person in the server room” becomes rows in a video table and an access table. One definition serves dashboards, alerts, questions and agents alike.
Governed, certified metrics
Metrics defined in governed SQL with versions, and marked certified, experimental or deprecated.
A metric such as badge entries or failed sign-ins is computed by one function wherever it is used, so an answer and a dashboard cannot disagree about it.
Saved, scheduled and structured
Save a question, share it and schedule it; or call the structured API with the same engine behind it.
The deterministic parser answers first. An optional model can stand in when a question is outside it, constrained to the semantic layer, and can narrate an answer when you opt in.
The ideas behind it
The words this page uses, explained once.
- Leg
- One pillar being asked one thing as part of a question. Each leg has its own plan and its own authorization. Read more: Leg
- Semantic layer
- The map from business words (a site, an employee, a vehicle) to the tables, detections and events that hold them.
- Certified metric
- A metric whose definition has been reviewed and marked certified, so it can be relied on wherever it appears.
- Exclusion
- A part of the answer policy kept from you, named in the answer with the reason and the policy.
In depth
The detail an evaluation asks for.
No privileges of its own
The engine authorizes every leg as the person asking and has no account to fall back on, so a question can never return more than its asker could read directly.
Deterministic first
Questions are parsed without a model. A model can stand in only for questions outside the parser, constrained to the semantic layer, and narration is opt-in and degrades to the plain answer.
One metric everywhere
A metric is consumed the same way by dashboards, alerts, questions and agents, so a number does not change with where it is read.
How it works
- Console
Ask
Type the question the way you would ask a colleague.
- Console
Read how it was answered
See what was understood, which pillars were asked, the queries they ran and what was left out.
- API
Give a purpose when policy asks
For deep-archive footage, state why you are asking and the footage leg runs.
- Console
Save it
Name the question, share it with the team and put it on a schedule.
In code
The same task in the CLI and both SDKs. Every call shown exists in the API.
prx CLI
Preview a cross-pillar question, ask it with a purpose and save it on a schedule
prx opsintel ask ask-plan --body '{"question":"who entered the server room last month without badging in"}'prx opsintel ask ask --body '{"question":"who entered the server room last month without badging in","purpose":"incident INC-4471"}'prx opsintel ask create-saved-questions --body '{"name":"Unbadged server-room entries","text":"who entered the server room last month without badging in","shared":true,"schedule":"0 7 * * 1"}'TypeScript SDK
Preview a cross-pillar question, ask it with a purpose and save it on a schedule
const question = 'who entered the server room last month without badging in';const { plan, excluded } = await client.opsintel.ask.askPlan({ question });const { answer } = await client.opsintel.ask.ask({ question, purpose: 'incident INC-4471' });await client.opsintel.ask.createSavedQuestions({ name: 'Unbadged server-room entries', text: question, shared: true, schedule: '0 7 * * 1' });Python SDK
Preview a cross-pillar question, ask it with a purpose and save it on a schedule
question = "who entered the server room last month without badging in"preview = client.opsintel.ask.ask_plan({"question": question})answer = client.opsintel.ask.ask({"question": question, "purpose": "incident INC-4471"})["answer"]client.opsintel.ask.create_saved_questions({"name": "Unbadged server-room entries", "text": question, "shared": True, "schedule": "0 7 * * 1"})The difference
The way this job usually goes, and the way it goes here.
The usual way
With ProjectX
An export from each system and an afternoon in a spreadsheet.
One question, joined across pillars, answered with its plan.
A zero that might mean “none” or might mean “you may not see it”.
Exclusions named in the answer, with the policy that made them.
A reporting tool with a service account that can read everything.
An engine with no privileges of its own, reading as the person asking.
Works with your tools
Every surface below drives the same product — script it, click it, or hand it to your existing tooling.
- Investigator console
- API
- prx CLI
- TypeScript SDK
- Python SDK
Questions, answered
Which systems can a question reach?
Video detections, identity and access events, lakehouse tables and cloud telemetry, mapped into one semantic layer so a question can join them.
Does it depend on a language model?
No. A deterministic parser answers first. A model is optional: it can stand in for questions outside the parser, constrained to the semantic layer, and narrate an answer if you opt in.
What happens when I may not see part of the answer?
That part is not read, and the answer says what was excluded and which policy excluded it.
Can our own tools call it?
Yes. A structured API sits alongside the natural-language one, and both are in the CLI and SDKs.
How is it priced?
Ask is billed per 1,000 questions at a published rate in Platform Credits. The rate is on the pricing page.
Products it works with
Same platform, same console, same invoice.
Start with ProjectX today.
Create a company in minutes and add this product to your invoice at the published rate.