Solutions
Solutions for every team that works in Splunk
Adjutant AI works in a few distinct ways: when someone asks, when something happens, on a schedule, when another agent calls it, and when data needs to move between systems. Below you find what each way is, and what it means for your team.
Ways to put it to work
One engine, one set of playbooks, one governance model. What differs is who or what starts the work.
Interactive Ask
Started by a person
Ask in plain language from inside Search, ITSI, ES or your own app. Every answer is grounded in your running Splunk and every artefact is validated before it is saved.
Event-driven Ask
Started by an alert, a notable or an ITSI episode
A Splunk alert action hands the event to a governed playbook, which investigates and reports back into the episode, the notable, a ticket or an e-mail.
Scheduled Ask
Started by a clock or by another run
Playbooks on a schedule, with overlap protection, dependencies and on-success or on-error chains. Every run leaves a history entry.
MCP Ask
Started by your corporate AI chat or another agent
Only the playbooks you tag for MCP are visible. The chat lists, starts and collects them through Splunk’s own MCP Server or Adjutant’s MCP endpoint, authenticated with Splunk tokens and scoped per organisation. In the other direction, Adjutant uses any MCP server you add as a tool.
AI-driven integration
Started by a schedule, governed by a contract
Records move between systems on a versioned mapping with four-eyes promotion, watermarks and drift checks. The runner transforms the data, not the model.
Domain Workspace
Started by a business user
Plain-language business questions answered with verified panels under the asker’s own roles. Released as a clickable preview; the working version follows.
Solutions by team
Pick a team to see what changes for them. Each card shows which way of working it uses.
Security
Triage alerts by business impact
Notables arrive with the service, owner, criticality and recent changes from your CMDB, so the queue is worked in order of impact instead of arrival.
Security
Detection content that fits your data
Splunk Security Essentials content matched against the data you actually have, with ATT&CK context, so you know which detections your data can actually support.
Security and platform
Let the SOC watch the AI
Every model call, tool call, configuration change and policy refusal is emitted as an OCSF event into an index Enterprise Security already watches.
IT operations
Know why a service is red
A reproducible root cause verdict over the real ITSI dependency graph. When the data behind a KPI is stale, it names the feed at fault instead of blaming the system.
IT operations and platform
Trust the data before the answer
Feed health from TrackMe, Cribl Stream and Splunk Edge Processor, checked before conclusions are drawn. Available on every edition.
IT operations
Health reports that arrive by themselves
Nightly or hourly checks run as a governed service account, chained in the right order, and delivered by e-mail or into ITSI.
Fraud and risk
Know what your data can detect
The Fraud Data Coverage Audit grades nine typologies, including AML, as ready, partial or blocked, and names the missing feed for each.
Fraud and risk
Find rings that stay under threshold
A ring scan inside the risk index groups accounts by what they share instead of by score, so seventeen quiet accounts become one visible ring.
Fraud and security
Risk rules you can read
Generated rules are weighted contributions with readable reasons, written into the ES risk framework or RBA. Nothing generated is enabled or scheduled for you.
Platform and business users
Working Splunk content from plain language
SPL, Simple XML and Dashboard Studio dashboards, alerts, lookups and AI Toolkit pipelines, validated against real data and saved into the app the user came from.
Platform, security and operations
ServiceNow and Splunk in sync, with proof
CMDB and CSDM records synced into Splunk on a reviewed mapping, with watermarks, drift checks and incident write-back to ServiceNow.
Splunk platform
Onboard new data with a quality score
Guided onboarding of new sources, with a data quality score before the data is trusted by anyone downstream.
Platform, security, operations and business
Give your corporate AI chat specific Splunk skills
Connect the company AI chat to the scenarios you choose, such as a host health check or an incident summary, instead of to Splunk as a whole. Tagged playbooks only, scoped per organisation, every run on the record.
Splunk platform
Rebuild the search head instead of maintaining it
Stateless operation keeps durable state in an object store, restores itself at boot and checks its own work before it runs anything.
Business users
Ask the business question, get a verified panel
Plain-language questions answered by reviewed searches under your own roles, with every claim labelled as fact, calculation or interpretation.
Business users and platform
Understand a search or dashboard
Explain what a search does in your environment, and why it stopped returning results. Available on every edition.
Service providers
One install, many customers
Organisations and business units separate customers cleanly. One licence key covers multiple Splunk environments with per-environment isolation.
Service providers and platform
Know what each tenant costs
Token and cost reporting per organisation and business unit, so AI spend can be charged back per customer or team.
See it on data that looks like yours
Start with the free Personal edition in your own Splunk, or book a walkthrough. Demo datasets for the fraud and ITSI root cause scenarios are ready. For teams, a 30-day Proof of Value with agreed success criteria is the fastest way to decide.