Skip to main content
InfrAI cuts analyst investigations down from 5 hours to 5 minutes, using the premier internet infrastructure intelligence dataset. Give it an observation - an IP, a domain, a range, a report indicator - and it searches across Infrawatch datasets, streams each step as it runs, and builds a connected evidence graph you can keep. InfrAI expanding an investigation graph from a seed host to passive DNS, service, and host evidence InfrAI is available from anywhere in the platform. Open the InfrAI chat, ask your question, and the investigation runs in place.

Watch a live investigation

See how a question becomes parallel pivots, streamed steps, and a graph.

Investigate an IP manually

Follow the same evidence path without the agent.

​
From a question to an evidence graph

The agent follows the same evidence path an analyst can inspect manually:
1

Understand the question

Start with an IP, domain, report, project asset, or a plain-language question. The agent keeps the current project and selected evidence in context.
2

Build validated searches

InfrAI translates the question into dataset-specific InfraQL and validates each query before execution.
3

Connect the evidence

Results from Scanning, DNS, proxy classifications, and Reports become typed nodes and relationships rather than an unstructured answer.
4

Save the investigation

Keep useful nodes, relationships, notes, and source observations in the project so another analyst can review or continue the work.

​
What the agent can do

  • Build validated searches - Turn a natural-language question into InfraQL and validate it before opening results.
  • Search across datasets - Combine host, service, DNS, proxy, and report context without losing the source observation.
  • Summarize evidence - Explain the important context already visible in the graph and link back to the underlying result.
  • Pivot through infrastructure - Expand from an IP or report indicator to connected services, names, networks, and reporting.
  • Create investigation graphs - Save nodes, relationships, and evidence in the selected project.
  • Preserve analyst context - Continue a conversation and return to the saved investigation later.
Every graph edge should lead back to an Infrawatch observation or attributed report. InfrAI supports the investigation; it does not replace verification. Open the linked result before treating a generated conclusion as fact.

​
Start from a host

Open a host and choose Investigate. Infrawatch creates an investigation in the selected project, seeds the graph with the host, and begins gathering related evidence. You can also ask InfrAI to:
  • Find infrastructure related to an IP or domain.
  • Explain an observed service or fingerprint.
  • Summarize report indicators.
  • Generate a Scanning or DNS query.
  • Add useful pivots to the current investigation.

Projects

Keep investigations, indicators, notes, and saved queries together.

Learn InfraQL

Read and adapt the queries InfrAI runs on your behalf.