Skip to main content

The Simba agent

Simba is Perpetual’s AI agent for content engineering, threat hunting, visualization, and case investigation. Simba works through the same product actions you do. You can ask it to continue a task you started in the app, take over one it started, or move between chat and the app as the task unfolds.

Simba works throughout Perpetual​

Simba can explore events, author content, build visualizations, and work on cases by making tool calls that map to Perpetual’s product API. Simba also has tool calls that directly manipulate the UI, which allows it to follow you as you work. You can keep the same chat open as a task moves from one part of the product to another, keeping the conversation, tool calls, and results in context.

  • Exploring events. Simba finds the datasets that could answer a question, inspects their schemas, writes Hamelin against them, runs those queries, designs visualizations for query results, and can even write custom scripts to interpret larger results.
  • Authoring deployable content. Simba can create and edit deployable content. It can build integrations and the parsers and mappers inside them, write detections, and create lookups. It can also update existing content to fix a query, tune its logic, improve its description, or update its metadata.
  • Authoring other content. Simba can also build dashboards that present query results, configure webhooks that send outbound requests when platform events fire, and write skills that capture a team’s procedures.
  • Reviewing a case. Most cases already contain an agentic investigation by the time you review them. Perpetual starts that work as soon as an alert becomes a case. Simba works with you to verify the findings, and conduct any follow-up investigation.
  • Working in the interface. On supported pages, Simba can edit what is in front of you. It can enter a query in the editor, change a dashboard panel in place, or take you to a resource you want to edit. If you are working on a query and just want suggestions, Simba can leave the current query text undisturbed and show its proposed revision in the editor’s diff view.
  • Working within the chat’s scope. The page you have open determines which interface actions Simba can take. The chat’s Space supplies the default context for content work, and your role grants determine what Simba may read or change.

Your team can extend Simba’s starting point​

Simba comes with knowledge of how queries, datasets, content, changesets, visualizations, and case work fit together, which it makes use of when helping you use Perpetual. It comes with instructions for each resource type, which it consults before authoring a detection, parser, mapper, lookup, or webhook. Creating a detection, for example, draws on both the detection authoring guide and current Hamelin guidance.

You can extend Simba with your own procedures and connections to external systems to combine Perpetual’s built-in workflows with those your team already relies on.

  • Skills give Simba reusable instructions for one of your team’s procedures. When a task matches a skill’s description, Simba automatically loads its full instructions. You can always invoke one directly by typing /name in chat.
  • HTTP tools let Simba call a defined endpoint in another system. As an example, you can use one to let Simba file tickets in external systems during an investigation.
  • MCP Servers give Simba access to the tools external systems expose to agents, allowing tasks in Perpetual to include calls into other systems your team commonly uses.

Taken together, these resource types help Simba behave like a configurable harness. It's not just a Perpetual copilot.

You can always review Simba's work​

Simba stages content creates, updates, and deletes in your current changeset, where you can see each edit and its validation problems (if any). You can work with Simba to fix problems in the open changeset, or edit any resource directly, yourself.

Simba never commits changesets. You must decide whether to commit, propose, or discard every changeset, including those you create with Simba. That decision also controls deployment. When new deployable content has deploy on, committing starts its first deployment. For content already in service, committing starts synchronizing the change with its live dataset. Simba turns deploy on by default unless you ask otherwise.

A case is the clearest durable record of Simba’s investigative work. Case findings are immutable by design, regardless of whether they came from a background investigation, a foreground conversation with Simba, or a user working directly in the case.

Outside agents can drive Perpetual through MCP​

If your team already has a preferred agent harness, you can connect it to MCP access, Perpetual’s Model Context Protocol endpoint. MCP will not feel as native to Perpetual as Simba because an outside harness cannot see or modify UI page content. That said, Perpetual designed MCP to come as close as the technology allows, letting your team keep the harness, model access, and conversation style it already prefers.

MCP access authenticates through OAuth. The user’s consent scopes the connection to one organization, and the resulting tool actions are restricted to and are logged as having been taken by that user. Perpetual checks the user’s current role grants on every call, just as it would do if the user were using Perpetual's UI or API.

Within those role grants, an outside agent can run queries, work with content and changesets, and act on cases. Perpetual needs no AI model provider configured for MCP because the harness supplies model access. Changes an outside agent makes over MCP become ordinary resource state, including staged changesets and case updates.

An outside agent cannot read the current page, put a query in the editor, edit a dashboard panel through page controls, or navigate you through the app. Its interactions always remain in the chat window of the outside harness.

Keep in mind: Perpetual uses MCP in two directions. This can be a bit confusing.

An MCP Server is content you author. It lets Simba drive another system. MCP access is the endpoint Perpetual exposes. It lets an agent in another harness drive Perpetual.