01 · Ask
You ask in plain language.
Type it, or say it. The assistant also gets the page you're on and the last few questions and answers, so follow-ups just work.
DeviceManager 7.0 · AI Assistant
Ask your fleet anything.
Answers grounded in your own data.
An AI assistant for IT operations and endpoint management. Ask about devices, incidents, patches and vulnerabilities in plain language; answers come from DeviceManager's own records, with your permissions, on the model you choose.
- Read-only lookups
- Your permissions
- Questions audited
- Cloud or local LLM
AI AssistantAnswers from DeviceManager data · read-only
Local model
New
How many devices are offline for more than 15 days?
12 devices have been offline for more than 15 days. Seven are in Branch – Pune; the oldest was last seen 41 days ago.
| Device | Group | Last seen |
|---|---|---|
| PUN-WS-014 | Branch – Pune | 41 days ago |
| PUN-WS-022 | Branch – Pune | 33 days ago |
| FIN-LT-107 | Finance | 27 days ago |
+ 9 more · open the list in Devices
Data useddevice searchfleet summary
Ask a question…
Ask
Example conversation: asked how many devices have been offline for more than 15 days, the assistant answers that 12 devices have, lists the longest-offline devices with their group and last-seen time, and shows the data used: device search and fleet summary.
Natural-language fleet queries
Ask the way you'd ask a colleague.
Devices, incidents, patches, vulnerabilities, printers and other network devices, in plain language. Name the device, ticket, group or time range and the answer gets sharper.
- How many devices are offline for more than 15 days?
- Which printers keep giving problems?
- How do I fix incident INC-01042?
- How is the setup doing overall?
- What types of issues keep recurring this month?
- Why is WS-FIN-014 slow?
- Which devices in the Finance OU are missing critical patches?
- Which vulnerabilities are actively exploited on our Windows laptops?
- What problems are reported most this month?
- How do I solve incident INC-00042?
- What is the status of LT-HR-031?
Ask from any page
An Ask button on every page.
It opens the assistant in a side panel that already knows which page you're on. The conversation follows you between pages; Open full page continues it on the AI Assistant page, and New starts afresh.
How it works
AI for endpoint management, without handing over the keys.
Many AIOps tools ask you to trust a black box. Here the model never touches your database, and every step between question and answer is permission-checked, visible and logged.
02 · Plan
The model never sees your database.
It can't write queries of its own. It can only request lookups from a fixed, read-only set, up to the limit you configure: 1 to 12 per question, 6 by default.
03 · Look up
Each lookup runs with your permissions.
Can't see an incident in Incidents? Neither can the assistant. Lookups cover devices, incidents, patches, vulnerabilities and network devices; modules outside your entitlements are never queried.
04 · Answer & record
Every answer sourced. Every question logged.
Data used lists the lookups behind each answer, and links only open pages inside DeviceManager. The Audit Log keeps the user, question, AI provider and lookups.
Question
priya.s · Manager · on the Patches page
Which Finance devices are missing critical patches?
question + context
AI model
Claude API or local modelDecides which lookups to request
Database
No database access · no queries of its own
requests a lookup
Read-only lookups · run as priya.s
- fleet summary
- device search
- device details
- performance evidence
- issue history
- network devices
- incidents & trends
- past fixes
- patches
- vulnerabilities
- installed software
Secrets excluded: passwords, keys, scripts, config backups
Modules outside your entitlements: never queried
results
Answer
5 Finance devices are missing critical patches; the oldest gap is 23 days. Open in Patches
Data usedpatchesdevice search
logged
Audit log
Userpriya.s
QuestionWhich Finance devices are missing…
ProviderLocal model
Lookupspatches, device search
Your model, your choice
Private AI for IT: in the cloud, or never leaving your network.
Use the Claude API, or run a local LLM with Ollama, vLLM or LM Studio on your own hardware. Either way, you know exactly what the model receives.
Claude API (cloud)
Choose the model, enter your API key. The server needs outbound HTTPS.
Your network
Internet
HTTPS
DeviceManager
api.anthropic.com
Sent with each question
Lookup results include host names, IP addresses, user names, incident titles and comments, and application names.
Local model (OpenAI-compatible)
Ollama, vLLM or LM Studio on a host you run. API key optional.
Your network
DeviceManager
gpu-host:11434
Sealed
Recommended model
Questions and lookup results go only to the endpoint you configure. Small models tend to pick the wrong data.
Assistant settings
Enabled
AI model
Claude API (cloud)
Local model (OpenAI-compatible: Ollama, vLLM, LM Studio)
Allow suggested actionsoff = answers only
SaveTest AI modelOK
Admin controls
One settings dialog. Every change audited.
Settings live on the AI Assistant page itself and need Assistant.Use plus Settings.Edit. Set the lookup and daily-question limits, decide whether suggested actions are allowed, then select Test AI model: a working model answers "OK". API keys are encrypted with the server's field-encryption key and never shown again.
The assistant is off until an administrator configures a model. Answer quality depends on the model you choose, so pilot it with a few people first.
Grounded in your history
“How do I fix it?” Starts with what worked here.
For fix questions, the assistant leads with the fixes your colleagues recorded on similar resolved tickets at your site. Anything that isn't from your records is labelled as such.
- Past fixes from your own resolved incidents come first
- Model advice is marked General guidance (not from your records)
- It can be wrong: open the linked incident and check before you act
How do I fix incident INC-01042?
From your records
INC-00987 (resolved) had the same symptom: printer offline after a driver update. Recorded fix: roll back to the previous driver package, then restart the print spooler.
INC-00911 (resolved): the print queue was re-added on the affected devices.
General guidance (not from your records)
If it returns after the next update, check that every device using this printer runs the same driver version.
Data usedincident detailspast fixes
Suggested actions, human-confirmed
It can suggest. Only a person can confirm.
With Allow suggested actions on, the assistant can propose a few routine tasks. Each one is spelled out in full, checked again when you confirm, and audited.
01 · Suggest
A card that says exactly what will happen.
A proposal arrives as a Suggested action card with an exact list of what will be done. Nothing happens until you select Confirm, or you can Dismiss it.
02 · Re-check
Confirm triggers five fresh checks.
Same person? Under 30 minutes old? Never used before? Every permission still held, re-read from the database? Actions still allowed? Fail one and it is refused.
03 · Run
The normal function runs, audited twice.
DeviceManager runs the same function the console page uses, with its normal audit entry, plus a second entry recording your confirmation.
04 · Limits
Some things are never on the menu.
No reboots, shutdowns, commands or software installation. A patch deployment only opens pre-filled; nothing installs until a person creates it. Prefer answers only? Switch suggestions off.
Suggested action
expires in 29 min
Prepare a patch deployment to fix a vulnerability
- Fixes
- Critical browser vulnerability (sample)
- Devices
- WS-FIN-014 · WS-FIN-022 · LT-HR-031
- Then
- Opens the pre-filled Patch Deployments form. Nothing installs until you create it there.
Nothing happens until you confirm.
Dismiss
ConfirmConfirmed
- Same person the suggestion was made for
- Less than 30 minutes old
- Not used before
- Every permission still held, re-read from the database
- Suggested actions still allowed
DonePatch Deployments form opened, pre-filled for 3 devicesOpen
10:47:12Patch deployment preparednormal audit entry
10:47:12Suggested action confirmed by priya.sconfirmation entry
Can be suggested
- Create an incident
- Add a comment to an incident
- Run a patch scan up to 20 devices
- Prepare a patch deployment for a vulnerability
- Acknowledge or resolve performance alerts
- Refresh inventory up to 20 devices
Never offered
- Reboots
- Shutdowns
- Commands
- Software installation
Safety by design
Guardrails in the architecture, not just in the prompt.
Hostile data stays data.
Device names, ticket titles and comments can contain anything. If that data tries to instruct the model, it cannot create external links or run actions.
Read-only lookups
A fixed set of lookups. The model writes no queries of its own.
Runs as the asker
Each lookup uses the asker's permissions. Can't see it? Neither can the assistant.
Entitled modules only
Modules outside your entitlements are never queried.
Secrets stay out
Results exclude passwords, keys, scripts and configuration backups.
Safe answers
No active content. Only links inside DeviceManager are clickable.
Every question audited
User, question, provider and lookups, recorded in the Audit Log.
Usage limits
Cap lookups per question and questions per user per day.
Off until configured
Nothing runs until an administrator chooses a model and enables it.
6default data lookups per question, adjustable from 1 to 12
200default questions per user per day (0 = no limit)
30 minlifetime of a suggested action, and it works only once
20devices at most per suggested patch scan or inventory refresh
Voice input · AI summary e-mail
Ask out loud. Get the week in one e-mail.
Voice, transcribed on your own network.
Speech recognition runs on a Whisper service you operate, such as whisper.cpp or an OpenAI-compatible server. Speak for up to 60 seconds; the recognised text is asked as the question, and audio is never stored.
Read answers aloud uses only voices installed on the user's own device, never an online speech service.
Headline
A steady week: patch coverage improved, but one branch and two printers need attention.
Needs attention
- 7 devices in Branch – Pune offline for more than 15 days
- 2 printers with repeat incidents
What changed
- Open critical vulnerabilities: 14 → 9
Trends
- Printer incidents up for a third week
1,284devices
96%online
23open incidents
9critical vulns
A briefing for managers, on schedule.
Daily, weekly or monthly, at the hour you choose. Facts are gathered with the same read-only lookups, using the subscription owner's permissions. If the model is unavailable, a plain data summary goes out instead.
E-mail figures are illustrative sample data. With the Claude API, the facts used for a summary are sent to the provider, as with questions.
FAQ
What security teams ask first.
The AI Assistant is part of DeviceManager, the self-hosted endpoint management platform. It works alongside vulnerability assessment and network monitoring in the same console.
- Does the AI model see our database?
- No. The model never sees the database and cannot run queries of its own. It can only call a fixed set of read-only lookups (fleet summary, devices, performance evidence, incidents and past fixes, patches, installed software, network devices from network monitoring and vulnerabilities from agent-based vulnerability assessment), each running with the permissions of the person asking. Results exclude secrets such as passwords, keys, scripts and configuration backups.
- Can the assistant change anything on our devices?
- Not on its own: answering is read-only. If you allow suggested actions, it can propose a small set of routine tasks (create an incident, add a comment, run a patch scan or refresh inventory on up to 20 devices, prepare a patch deployment, acknowledge or resolve performance alerts). Each one runs only after a person selects Confirm and fresh checks pass. It never offers reboots, shutdowns, commands or software installation.
- Can we run it fully on-premises, with nothing leaving our network?
- Yes. Choose a local model on any OpenAI-compatible server, such as Ollama, vLLM or LM Studio, and questions and lookup results go only to the address you configure. Voice input uses a Whisper service you run yourself, and read-aloud uses only voices installed on the user's own device. DeviceManager itself is self-hosted on your own server.
- Which AI models can we use?
- Either the Claude API (cloud), where you choose the model and enter your API key, or a local OpenAI-compatible model. For a local model, pick one that supports tool calling, with about 14 billion parameters or more; smaller models tend to pick the wrong data. Answer quality depends on the model you choose, so pilot it with a few people before rolling it out widely.
- What does the assistant log?
- Every question is recorded in the Audit Log with the user, the question, the AI provider and the lookups used. A confirmed suggested action gets its normal audit entry plus a separate confirmation entry, and every change to the assistant's settings is audited too.
- Who can use the AI Assistant?
- Users whose role includes the Assistant.Use permission: SuperAdmin, Admin and Manager by default, and you can add it to custom roles. The assistant stays off until an administrator configures a model, configuring it needs Assistant.Use plus Settings.Edit, and you can cap the number of questions per user per day.
Let's talk
See it answer questions about your own fleet.
Book a tailored demo: we'll walk through the assistant, help you choose between the Claude API and a local model, and plan a pilot with a few users in your environment.