Platform

Ask your alerts a question

Schildmark Analyst answers questions about your environment in plain language and runs the investigation behind the answer, over your alerts, vulnerabilities, inventory and connected services. You decide whether it runs, and where its requests may go.

From a question to a patched machine

The analyst finds what is exploitable, explains it so you know what to do, and proposes the fix. With unattended approval on for those machines, the fix runs without anyone stepping in, and the vulnerability scan confirms it.

You askedIs anything on my machines exploitable right now?

Read as Vulnerabilitiesall machinesknown exploited first

Google Chrome on 14 Windows laptops has a vulnerability that attackers are using.

CVE-2025-6554 is a type confusion in V8, Chrome’s JavaScript engine: a crafted web page can read and write memory it should not reach. It was exploited before the fix was out and is on CISA’s list of known exploited vulnerabilities. Chrome 138.0.7204.96 fixes it; update all 14 laptops.

CVE: CVE-2025-6554
Severity: High
Known exploited: Yes, CISA KEV
Machines: 14 Windows laptops
Fixed in: 138.0.7204.96
Channel: winget (pilot)

Proposed fixUpdate Google Chrome on 14 machines

137.0.7151.120 138.0.7204.96

Unattended approval: on for laptops, low risk

Verify09:14:02
Plan09:14:05
Dry run09:14:31
Approved automatically by policy09:14:32
Installed09:16:48
Verified09:22:10

Remediatedthe vulnerability scan confirms the fix 0 machines exposed (14 before)

High CVE-2024-6387 (regreSSHion) confirmed on web-01Vulnerability check 3 machines, just now

You askedWhat is this, and what do I do about it?

Read as Alertweb-01vulnerability check

OpenSSH on 3 Ubuntu servers can be attacked without a password.

CVE-2024-6387, known as regreSSHion, is a race condition in a signal handler of sshd. On glibc-based Linux, an attacker who can reach the SSH port may run code as root without signing in. OpenSSH 8.5p1 to 9.7p1 are affected; on Ubuntu 22.04 the fix is openssh-server 1:8.9p1-3ubuntu0.10.

CVE: CVE-2024-6387
Severity: High
Machines: web-01, web-02, app-03
Affected: OpenSSH 8.5p1–9.7p1
Fixed in: 1:8.9p1-3ubuntu0.10
Channel: apt

Proposed fixUpdate openssh-server on 3 machines

openssh-server 1:8.9p1-3ubuntu0.10

Unattended approval: on for web servers, low risk

Verify02:41:17
Plan02:41:19
Dry run02:41:44
Approved automatically by policy02:41:45
Installed02:43:02
Verified02:58:30

Remediatedthe vulnerability scan confirms the fix 0 machines exposed (3 before)

You askedWhich Macs need attention?

Read as VulnerabilitiesmacOSfixable first

Two Macs run a Homebrew curl with a heap overflow.

CVE-2023-38545 is a heap buffer overflow in curl’s SOCKS5 proxy handshake, triggered by a very long host name. curl 7.69.0 to 8.3.0 are affected and 8.4.0 fixes it; Schildmark can update the Homebrew package. hr-lap-2 also waits for a macOS update: that one is installed on the Mac itself.

CVE: CVE-2023-38545
Machines: hr-lap-2, design-mac-1
Installed: curl 8.3.0 (Homebrew)
Fixed in: 8.4.0
Channel: Homebrew (pilot)
macOS update: Detected; install on the Mac

Proposed fixUpdate curl on 2 machines

8.3.0 8.4.0

Unattended approval: on for laptops, low risk

Verify16:05:40
Plan16:05:42
Dry run16:06:03
Approved automatically by policy16:06:04
Installed16:07:12
Verified16:12:51

Remediatedthe vulnerability scan confirms the fix 0 machines exposed (2 before)

Demo with sample data. CVE details are real. Windows and macOS patching are in pilot; macOS system updates are detected and explained, then installed on the Mac itself.

More it answers

Plain questions, answered from your own alerts, machines and vulnerabilities. Every answer shows what it was based on, and the actions it offers follow your role.

Demo with sample data.

You askedIs this brute force a real problem?

Likely malicious, but nothing got in.

Verdict: Likely malicious
Evidence: 600 failed SSH logins on web-01 from 203.0.113.45 in 24 hours; none succeeded. The address reached no other host.
Reputation: AbuseIPDB score 100
Next step: Block the address at the perimeter; keep the rule on.

You askedWhat changed on web-01 since yesterday?

Three changes, one of them worth a look.

09:22: openssl updated to 3.0.2-0ubuntu1.18 by a patch job; fix verified.
14:10: /etc/nginx/sites-enabled/app changed (file integrity).
16:42: New local user deploy created with sudo rights. Nobody on your team has claimed it yet.

Daily standupGenerated 08:00 for the last 24 hours

A quiet night, two things for today.

Alerts: 12 critical, 148 high in 24 hours; 9 of the critical ones are the same brute force, already blocked.
Patching: 7 fixes verified overnight; 1 job waits for a second approver on db-02.
Machines: fin-lap-7 has not reported for 26 hours.
Today: Approve the db-02 job; ask the owner of fin-lap-7.

You askedWhich machines are still exposed to regreSSHion?

None. The last three were fixed yesterday.

Fixed: web-01, web-02, app-03: openssh-server 1:8.9p1-3ubuntu0.10, verified 02:58.
Not affected: bastion-01 runs OpenSSH 8.2p1, older than the affected range.
Still to check: build-3 has never reported its software list.

Schildmark Analyst answering "show recent alert analysis": one external address is brute forcing SSH on web-01, with alert counts, a severity breakdown, the top alerts table and the actions it can take. — An answer in Schildmark Analyst.Sample data

How it read the question. Data source, period and host, including what it inferred.
The answer first. Then the figures and the alerts it is based on.
What it may do. Actions follow your role’s permissions and the protected addresses.
Check before you act. The analyst can make mistakes, and says so.

Your AI data policy

Questions and the data the analyst reads go to a language model. Which one is your decision, and the hosted analyst’s gateway enforces it on every request.

Off

Every request is refused, and the analyst says AI is switched off. Nothing leaves.

Standard

Requests go through our LLM gateway to our standard AI provider, within a monthly allowance for your organisation.

BAA only

Requests go only to a provider that has signed a business associate agreement (HIPAA) with us. If none is available, they are refused, never sent elsewhere.

No BAA-covered provider is in service yet, so today BAA only refuses every request. Ask us before choosing it.

Your own model

Without the hosted analyst, it uses the OpenAI-compatible endpoint you configure: vLLM or Ollama on your own hardware, Azure OpenAI, or another provider whose data handling suits you.

We do not “redact” logs and call it HIPAA: names in log lines cannot be found reliably. The policy decides where data may go instead.

What it does

Ask: “Which hosts talked to this IP?” “What changed on web-01 yesterday?” Threads are kept.
Alert triage: Alerts grouped into incidents, with a narrative of what happened.
Daily standup: A summary of the last day.
Act: Acknowledge, close, mute, block at the perimeter, propose a patch, or open a Jira ticket.

Where it runs

On your stack: The analyst runs beside your console and calls the model endpoint you set. Conversations stay in your stack.
Hosted analyst: An add-on: we run it for you with our LLM gateway, in containers of your own. Its conversations are still stored in your stack; the alert data it reads leaves your infrastructure while it works.
When the model is down: It still returns the data it found and says that manual review is needed.

Talk to sales

Tell us about your machines, your firewalls and the audit you are preparing for. We answer within one working day.

Talk to sales sales@schildmark.com