Mobula · Mobi AI Analyst
Not a chatbot.
An analyst that
does the work.
Mobi is native to the platform. It knows your live alerts, your customer history, your playbooks, and every help article. Ask it anything in plain language - it doesn't just answer, it acts.
- Ransomware staging - FIN-DB-03 (untouched 2h 14m)
- Kerberoasting - DC-01 (untouched 1h 47m)
- Brute force VPN - p.alvarez (assigned to m.chen)
Mobi has full context. Always.
Mobi isn't a wrapper around a generic LLM. It has live read access to every corner of your Mobula tenant - alerts, cases, customers, playbooks, team schedules, and the full product documentation. When you ask a question, it answers from your data, not from a training set.
It doesn't just answer. It does.
Most AI assistants give you information and leave you to act on it yourself. Mobi closes the loop. Tell it to run a playbook, escalate an alert, draft a customer message, or assign a case - it does it, then confirms.
Everything Mobi can do, in plain language.
No commands, no menus. Just describe what you need. Mobi maps your intent to one of 40+ actions across alerts, cases, customers, playbooks, and the platform itself.
| Say something like... | What Mobi does | Domain |
|---|---|---|
| "Show me all unassigned criticals" | Queries live alert queue, filters by severity and assignment status | Alerts |
| "Escalate this to the CISO" | Updates severity, logs decision, triggers escalation notifications | Alerts |
| "Run the ransomware playbook" | Executes PB-014 step by step, confirms each action, reports back | Playbooks |
| "What playbook fits a phishing case?" | Reads playbook library, ranks by relevance to the alert type | Playbooks |
| "Draft an update for Acme" | Reads customer comms history, generates style-matched message | Customers |
| "Who is the CISO contact at FinServ?" | Looks up customer profile, returns contact with role and channel | Customers |
| "Summarise CASE-2026-041" | Reads case notes, timeline, and verdicts - returns a tight summary | Cases |
| "Have we seen this technique before?" | Searches closed case history for matching MITRE techniques | Cases |
| "How do I add a custom connector?" | Looks up help docs, returns step-by-step with a direct link | Platform |
| "Assign this to r.haddad" | Updates case assignment, notifies the analyst, logs the change | Platform |
Your team never needs to leave the platform to get help.
Mobi knows every help article, every setting, every workflow in Mobula. Junior analysts can ask how to do something and get a step-by-step answer with a direct link - or ask Mobi to just do it for them.
Or - I can create it for you right now. Want me to?
A whitelist tells the detection engine to treat the entity as known-good and skip evaluation entirely - nothing is logged for it.
For an internal scanner, suppression is usually better: you keep the logs for audit purposes, you just stop the noise.
Native to the platform · acts on your data · plain language
The analyst that's always
there, always ready.
Mobi handles the routine, accelerates the complex, and teaches the junior - so your human analysts spend their time on what actually needs a human.