DOCUMENTATION

CYONIX Help

Set up your platforms, ask the agents and read the figures. Everything here describes what the product does today.

Getting started

CYONIX reads security alerts and endpoint inventory from the platforms you connect, then lets two agents answer questions about them in plain language. It is read-only: it never isolates a host, closes an alert, resets an account or changes anything in your platforms.

Open Integrations and connect at least one alert source, CrowdStrike Falcon or SentinelOne.
Connect an AI provider on the same page and choose a model. Without one the agents cannot answer.
Open Investigations and ask a question, or open the vCISO Agent for a briefing.

Connect FalconCreate a read-only API client Connect SentinelOneAdd a token and console URL Ask the InvestigatorQuestions about alerts and hosts Brief with the vCISO AgentA view for each executive role

Use only the platforms you have connected. Each page names the platforms it read and says so when one could not be read.

Connect CrowdStrike Falcon

CYONIX uses an API client you create in the Falcon console. Give it read access only.

1. Create the API client

In the Falcon console, open Support and resources and then API clients and keys.
Create a new API client and choose the scopes below.
Copy the Client ID and Client secret straight away. The secret is shown once.

2. Scopes

Scope	Needed for
`Alerts: Read`	Required Alerts, counts, weekly volume, time to resolve.
`Hosts: Read`	The endpoint inventory, check-ins, silent machines and sensor details.
`Host Groups: Read`	Optional Groups machines by their Falcon host group. Without it, Falcon machines show as unassigned.
`IOCs`, `Prevention policies`, `Event streams` (read)	Optional Reported by Test connection so you can see what the key can do. CYONIX does not act on them.

3. Base URL

Use the API address for your Falcon cloud. It must end in .crowdstrike.com or .crowdstrike.mil.

US-1: https://api.crowdstrike.com
US-2: https://api.us-2.crowdstrike.com
EU-1: https://api.eu-1.crowdstrike.com

For US-GOV-1 or another cloud, use the address CrowdStrike lists for your tenant.

4. Save and test

On Integrations, choose Configure on the CrowdStrike card, enter the three values and save. Then choose Test connection. The result lists which scopes the key has. A 403 for alerts means Alerts: Read is missing.

Connect SentinelOne

In the SentinelOne console, create an API token for a user or service user that can view threats and endpoints. A read-only role is enough.
Copy the token when it is shown.
On Integrations, choose Configure on the SentinelOne card. Enter the token and your Console URL, for example https://your-console.sentinelone.net. The address must end in .sentinelone.net.
Save, then choose Test connection.

If the token can read threats but not endpoints, alerts still work and the endpoint inventory is simply unavailable. CYONIX says so rather than showing zero.

SentinelOne rates threats by confidence (malicious or suspicious), not by severity. CYONIX shows it in SentinelOne's own words and never turns it into a Critical, High or Low rating.

Connect an AI provider

The agents use the provider and model you choose. CYONIX supports Claude, OpenAI, DeepSeek and OpenRouter.

On Integrations, choose Configure on the provider card and paste your API key.
Choose Choose model. CYONIX asks the provider which models your key can use and lists them.
Optionally set the reasoning effort. Higher effort is slower and costs more. Provider default leaves it to the provider.

You can also change the model for a single chat from the composer. Every answer records which provider, model and effort produced it.

Each question and each scheduled run is a call to your provider, billed to your account with them. CYONIX shows call counts, not prices.

Investigator

The Investigator is for analysts. Ask about alerts, hosts, users or techniques and it answers from the alert evidence it was given.

What it reads

Without an alert open, the most recent alerts from each connected platform. Name a period, such as the last 30 days, for exact counts over all of it.
With an alert open (from Alerts), that alert's full record and related alerts.

What an answer looks like

A verdict (Malicious, Suspicious, Benign or Undetermined) with a confidence level, only when you ask for a disposition on one alert.
Observed facts kept apart from conclusions, a recommended action for you to carry out in the platform, and the next check that would change the answer.
The evidence used, with its source, time and any truncation, under Evidence used.

Working with a chat

Copy any question or answer.
Edit one of your questions to ask it again. The answers after it are replaced.
Chats are saved. Rename, pin or delete them from the list. A saved chat made with a different set of connected platforms is read-only.

vCISO Agent

The vCISO Agent briefs executives on the endpoint security posture, in plain language, from the same connected platforms. Pick a perspective and the page and the agent lead with what that role owns.

Perspective	Leads with
CEO	Weekly change, open ransomware, Critical and Malicious counts, endpoints checking in
CFO	Auto-blocked share, silent endpoints, time to resolve, weekly change
COO	Alerts on servers, open alerts, endpoints with no business unit, silent endpoints
CIO	Endpoints checking in, silent endpoints, alerts on servers, sources current
CTO	Alerts by platform, identity and email alerts, auto-blocked share
Chief risk officer	Items for the risk register: ransomware, servers, Critical, Malicious
General counsel	Activity that may need legal review: ransomware, identity and email, infected endpoints
CISO	The technical view: open, Critical, Malicious, ransomware, triage and resolve times
Board	Direction, ransomware, coverage and auto-blocked share, in a few short points

On the page

Posture banner and role panel. The headline and the few figures this role opens the page for.
At a glance. Open alerts by platform, endpoint check-ins, where alerts come from, protection, and median time to resolve.
Cyber resilience pillars. Evidence status per area: Current, Needs attention, Limited evidence or Unavailable. These are statuses, not scores.
What changed. This week against last week, and the 12-week trend.
Decisions. At most one next step, tied to a figure, for the leader to raise with the security team.
Risk map. Machines grouped by business unit, Falcon host group or SentinelOne site, with the findings that name them.

Ask the agent

Choose Chat with the vCISO Agent to ask questions in the same perspective. Ask it to set up a recurring briefing and it prepares a proposal for you to confirm (see Schedules).

Export

Export briefing downloads a text briefing marked draft for review. A person should read it before it is relied on or shared.

The vCISO Agent never states a cost, loss, downtime, SLA figure or compliance verdict, never says the organisation is safe, and never says a breach did or did not happen. It says what the data shows, what it does not cover and who holds the rest.

Reading the figures

Open alerts: New, reopened and in-progress alerts (Falcon) plus unresolved and in-progress threats (SentinelOne). The page shows each platform's own count beside the total.
Critical: Falcon's own Critical severity only. SentinelOne has no severity, so it is never counted here.
Malicious (SentinelOne): SentinelOne's own confidence rating. It is not a severity and is never added to Critical.
Not reported: A value the connected platforms do not give, such as open cases or SLA breaches. It is shown as not reported, never as zero.
Latest N alerts: Figures that come from alert records cover the most recent alerts loaded (up to 300), and say so. Weekly totals and open counts come from the platforms' own counts over everything.
Endpoints checking in: The share of machines in the inventory that reported within the last 7 days. A machine that never reported counts as silent. It speaks only for machines the platforms enrol.
Median time to resolve: Falcon only, and for Falcon's own detections when it has any. The sample size is shown, and under 20 alerts it is marked too few to judge. It is not an SLA.
Median time to triage: Falcon only, over the alerts that have a triage time recorded. Often a small sample.
Blocked automatically: The share of SentinelOne threats whose mitigation status is mitigated. It says nothing about Falcon.
Where alerts come from: Each platform's own data domain. Falcon also carries alerts it receives from Microsoft Defender, M365 and Azure, so Email and Identity alerts are not endpoint alerts.
Labelled testing: Alerts whose title says testing. They are counted like any other, and the page tells you how many there are because they inflate volume.
Unassigned and Unrated findings: Unassigned means no business unit or group could be read for a machine. Unrated means the findings come from a platform that gives no severity, so the page does not rate the risk. Treat them as unrated, not as low.

Alerts

The Alerts page lists alerts from every connected platform, newest first. Choose a row to open that alert in an investigation.

Time range, source, status and severity are applied by the platforms, so they cover every alert there and the count at the top is exact.
Search, tabs and sorting apply to the alerts loaded on screen. Choose Load older alerts to widen them.
Statuses are grouped across platforms: New or reopened, In progress and Closed or resolved.
SentinelOne has no severity, so choosing a severity leaves it out. Its alerts show their own confidence rating.
The list is loaded when you open the page. It does not update by itself, so reload to see new alerts, and a reload within 30 seconds may show the same list.

Schedules

A schedule asks the vCISO Agent a question on a timetable and saves each result as a chat.

Create one

From a template. Open Schedules, choose the Templates tab, pick a briefing for a role and review the details before you save.
From scratch. Choose New task and fill in the question, perspective, repeat and time.
By asking the vCISO Agent. Say what you want, for example a weekly CFO briefing on Mondays. The agent prepares a proposal card. Nothing is scheduled until you choose Create schedule.

Good to know

Briefings repeat daily, on weekdays or weekly. Tasks created by hand can also repeat hourly or at an interval of 15 minutes or more.
Tasks run while the CYONIX service is running. A task that came due while it was stopped runs once when it starts again.
Each run is a call to your AI provider. The Schedules page shows roughly how many calls a month your enabled tasks make.
Notifications appear on the Schedules page while it is open. Briefings are not emailed.
A schedule request does not read your platforms. Only the scheduled run does.

Security and privacy

Read-only. CYONIX has no way to act on your platforms.
Keys. API keys and secrets are sent to the CYONIX service, never shown again and never kept in your browser. Create keys with the smallest scopes that work.
What the AI provider receives. Your question, a summary of the alerts and figures loaded for it, and earlier turns of the chat. Secrets that appear in alert data are masked before they are sent.
Untrusted data. Hostnames, titles and command lines in alerts can be written by an attacker. The agents treat them as evidence, flag any text aimed at them and never follow it.
Saved chats. Each answer is saved with the evidence it used, so it can be reviewed later.
Preferences. Profile and appearance settings are stored in this browser only.

Troubleshooting

What you see	What to do
The CYONIX service is not connected to this site yet	The page cannot reach the service. Contact your administrator.
Status unavailable on an integration card	The service did not answer. Reload, and check the service is running.
Falcon: not allowed to read alerts	Add `Alerts: Read` to the API client, then test again.
Falcon machines all show as unassigned	Add `Host Groups: Read` to the API client. Business units appear only when machines carry a `FalconGroupingTags/` tag.
No endpoints from SentinelOne	The token can read threats but not endpoints. Use a token whose role can view endpoints.
A platform is listed as not read	Its credentials or network failed for that request. Totals leave it out and say so. Test the connection on Integrations.
Choose a model before sending	Connect an AI provider and choose a model, or pick one in the composer.
An answer ends with Cut off	The provider hit its length limit. Ask a narrower question.
Figures differ from the platform console	CYONIX shows the time it read them. Alert-based figures cover the latest alerts loaded. A platform may also lag behind its own console by a short while.
A saved chat is read-only	It was made with a different set of connected platforms. Start a new investigation to use the current ones.
A schedule did not run	Tasks run only while the service is running, and a paused task does not run. Open the task and check its run history.

FAQ

Can CYONIX isolate a host or close an alert?

No. It recommends actions for you to carry out in the platform. It never says an action was taken.

Is it real time?

No. Pages load when you open them and the vCISO page refreshes when you return to its tab. Each page shows when its data was read.

Why does the vCISO Agent not say we are safe?

Quiet dashboards can hide machines that are not reporting. It reports coverage and gaps first and never treats no alerts as an all-clear.

Why is a figure marked not reported?

No connected platform gives that value. Showing zero would be a guess.

Can the agent create a schedule by itself?

No. It proposes one and you confirm it, because every run is a paid model call.

Which AI provider should I use?

Any of the four works. Pick the model your organisation already approves for security data, and set a spending limit with the provider.