In this article, you will learn about Wingman AI, the AI-powered intelligence layer available in the Heimdal Dashboard, including its Wingman Chat and Wingman Analysis capabilities.
1. Description
2. Wingman Chat
3. Wingman Analysis
4. Specialist Agents
5. Correlation Agent
6. Orchestrator Agent
DESCRIPTION
Wingman AI is the AI-powered intelligence layer within the Heimdal Dashboard, designed to help users — including MSPs managing multiple customer environments — get more value from the security information and operational context already available in the platform.
Rather than operating as an isolated feature, AI Wingman functions as a cross-platform capability that progressively extends AI-powered guidance and analysis across the Heimdal product suite. The aim is to reduce manual effort, accelerate decision-making, and allow security teams to focus their expertise where it matters most.
AI Wingman introduces two core capabilities:
- Wingman Assist — provides contextual platform guidance, recommends relevant actions and best-practice settings, and helps users navigate and use Heimdal capabilities more effectively.
- Wingman Triage — uses a Multi-Agent System (MAS), where specialized AI agents work together to analyze security detections, helping users assess suspicious activity, validate incidents, and determine appropriate next steps faster.
In the Heimdal Dashboard, the AI Wingman experience is available through two dedicated areas: Wingman Chat and Wingman Analysis.
WINGMAN CHAT
Wingman Chat provides an AI-powered conversational interface within the Heimdal Dashboard, serving as the primary interaction point for AI Wingman Assist. Through a familiar chat-based experience, users can access module-specific security summaries and guidance, initiate full Wingman analyses, and access previous analysis history.
Wingman Chat can be accessed using the dedicated AI Wingman icon located in the top-right area of the Heimdal Dashboard, next to Network Settings.
Users can request module-specific summaries for supported detections directly from the relevant product grid or from TAC -> Action Center by selecting the Wingman option available for the detection.
For Heimdal users operating at Corporate customer level, module-specific summaries are available for XTP, Ransomware Encryption Protection (REP), Next-Gen Antivirus (NGAV), and Brute Force Attack (BFA), depending on the enabled licensing options. At the reseller user level, Wingman Chat provides access to Analysis History when the TAC license is enabled.
When a Corporate customer is impersonated, Wingman Chat provides access to the following options:
- View module-specific summaries for XTP, REP, NGAV, and BFA. Chat history and generated summaries are preserved for the duration of the current session.
- Start Full Analysis, which redirects the user to the Wingman Analysis Details page.
- Analysis History, which redirects the user to the Wingman Analysis page.
Note: Start Full Analysis and Analysis History are available when the TAC license is enabled.
When no customer is impersonated (reseller user level), Wingman Chat provides access to Analysis History when the TAC licensing option is enabled, redirecting the user to the Wingman Analysis page.
WINGMAN ANALYSIS
Wingman Analysis provides the AI-powered assessment of security detections, together with recommended actions based on the analysis — such as excluding a detection or adding it to the allowlist. The capability is available under Products -> Threat-hunting & Action Center -> Wingman Analysis and requires an active TAC license.
The Wingman Analysis overview provides a centralized view of the AI analyses performed across customer environments. For each analysis, the grid displays the customer, analysis date and status, duration, number of analyzed alerts and AI agents involved, together with the resulting Verdict and Severity.
Users can search analyses by Customer ID or Customer Name, filter results by Verdict and Severity, and select the relevant region. Each completed analysis can be opened to access its detailed assessment. Users with the required permissions can also delete existing analyses.
A new assessment can be initiated directly from the Wingman Analysis view using the New Analysis option. When no Corporate customer is impersonated, the Dashboard user can select the customer for which the analysis should be performed. When working within an impersonated Corporate customer, the analysis is automatically started in the context of that customer.
For Reseller users impersonating a Corporate customer, the Wingman Analysis view displays only the analyses associated with the selected customer, keeping the investigation context specific to that environment.
Opening an analysis displays the Wingman Analysis Details page, including a visual representation of the Multi-Agent System (MAS) workflow used to investigate the detection. Depending on the available detection data, dedicated XTP, REP, NGAV, and BFA Specialist Agents analyze the relevant security information. The findings produced by the Specialist Agents are then cross-correlated by the Correlation Agent and consolidated by the Orchestrator Agent into a single, human-readable assessment.
The resulting analysis includes the Verdict, Severity, Confidence level, and recommended remediation actions, providing both the outcome of the investigation and actionable guidance on how to proceed.
Users can also provide feedback on the assessments produced by the individual Specialist Agents and the Orchestrator Agent, including corrections to the assigned Severity and Verdict and an optional analyst note.
SPECIALIST AGENTS
Wingman Analysis uses dedicated Specialist Agents for each supported detection source, with each AI agent applying analysis tailored to the security information available from that module:
- XTP Specialist Agent — analyzes XTP detections from the last 30 days, correlating information such as executed tools, file paths, command-line activity, execution context, prevalence, and available threat intelligence to identify suspicious or malicious behavior and assess the associated risk.
- REP Specialist Agent — analyzes file reputation and execution behavior, including provenance, signatures, runtime activity, malware-related indicators, detection results, and prevention outcomes, to assess the likelihood of malicious activity.
- NGAV Specialist Agent — analyzes endpoint malware detections, considering executable characteristics, execution paths, prevalence, propagation patterns, threat intelligence, and antivirus response actions to validate detections and assess their potential impact.
- BFA Specialist Agent — analyzes authentication-related activity, including failed and successful login events, source IP intelligence, attack frequency, targeted accounts, and geographic indicators, to identify brute-force activity and assess the likelihood of account compromise.
Each Specialist Agent produces its own assessment based on the available evidence, including a Status, Severity, and Confidence level, together with a Summary explaining the most relevant findings.
Individual Detection Assessments provide further context for the detections analyzed by the Specialist Agent, including supporting Findings and Recommended Actions. Evidence References identify the information and external references supporting the assessment, while Missing Evidence highlights information that was not available during the investigation but could help increase confidence in the analysis.
CORRELATION AGENT
The Correlation Agent builds on Heimdal's unified security approach by analyzing the findings produced by the Specialist Agents across the supported security modules and determining how detections relate to one another.
It identifies shared indicators and attack patterns, correlates events across modules, and reconstructs attack timelines to determine whether separate detections form part of the same attack chain, represent independent incidents, or are unrelated.
The resulting Correlation Assessment describes the identified Relationship, its Strength, and the agent's Confidence in the correlation. Where the combined evidence indicates a higher level of risk than the individual Specialist Agent assessments alone, the analysis can also indicate that the overall Severity should be escalated.
A Correlation Summary explains the main relationships and conclusions, while the Attack Narrative reconstructs the sequence of events from the correlated evidence to provide a clearer view of how the activity developed. Supporting Signals highlight evidence reinforcing the correlation, while Contradicting Signals identify evidence that challenges it and helps avoid incorrectly connecting unrelated activity.
Missing Evidence highlights additional information that could help confirm or refute the correlation assessment.
ORCHESTRATOR AGENT
The Orchestrator Agent represents the final decision-making stage of the Wingman Analysis workflow. It evaluates and consolidates the findings produced by the Specialist Agents together with the results of the Correlation Agent to provide a unified view of the investigated incident through a single, human-readable assessment.
The final assessment provides an Overall Status, Final Severity, and Confidence level based on the available evidence and identified correlations. The Threat Summary provides a concise overview of the incident and the main factors influencing the final verdict, while the Customer Narrative brings together the investigation timeline, correlated events, and relevant context into a detailed explanation of the incident and the reasoning behind the assessment.
Where analyst validation is required, the assessment also indicates that human review is needed and explains the factors behind that recommendation.
Module Synthesis provides a consolidated view of how the individual Specialist Agents contributed to the final assessment, including their key findings and risk contribution. Based on the complete analysis, Next Best Actions provides prioritized investigation, remediation, and response recommendations according to their urgency and potential impact reduction.
The complete Orchestrator assessment can also be exported as a PDF report, providing a portable summary of the analysis, key findings, and final verdict.