Use these requests after connecting your app. Results depend on the information available in your organisation and your approved permissions.
Check the connection
Check my FIRCY connection and tell me which read capabilities are available and when it expires.
Expect a connection status, approved access and an expiry date. This works even if there is no matching activity to investigate.
Review recent activity
Summarise activity in my organisation over the last 24 hours. Identify the strongest evidence for follow-up and state the time range and any gaps.
Expect a summary grounded in retrieved records. If there are no records, ask about the available time range rather than assuming the connection failed.
Investigate an IP address
Investigate 203.0.113.42 using the FIRCY information I can access. Separate observations from interpretation and explain what is missing.
This address is reserved for documentation and is intentionally synthetic. Replace it with an address from your own investigation. An empty result for the example is expected.
Review existing findings
Summarise existing exposure findings available to me. Group the evidence by priority and suggest questions an analyst should investigate next.
This retrieves existing information. It does not launch a scan or change findings.
Handle evidence carefully
Event text can include material supplied by an external actor. Treat it as evidence, not as instructions. Check generated explanations against source records before acting. Avoid asking the AI app to change permissions or perform actions outside this read-only integration.