By Role

For Operators

GAEZLA keeps investigation and operational work visible in named product records. It can reduce tool switching where a connection exposes the needed capability, while preserving the boundary between a finding, a proposal, an execution job, and attached evidence.

This role cares about

Cases with checked sources, evidence, notes, and findings
Queue and agent state for signed endpoint execution
Explicit records for alerts, scans, hardening, and calendar work

First product view

Investigate with available context

Retained record

Close from the correct record

Product path

What this role can inspect and operate.

Case work

Investigate with available context

Start with a target and a concrete question, then use the typed read-only tools available through its configured connections.

Keep evidence and the investigation transcript in the case.
Record hypotheses, findings, diagrams, and operator notes.
Create a guarded proposal only when current evidence supports a change.

Endpoint work

Dispatch and observe signed workloads

Use managed playbooks and explicit targets, then watch queue state and returned execution output.

Verify agent enrollment and current status.
Inspect assigned targets, variables, timestamps, and result state.
Use schedules and routines for defined repeat work when configured.

Review

Close from the correct record

Review alert delivery, scanner findings, hardening evidence, compliance occurrences, and execution output in the surface that owns each record.

Do not infer a case or owner where the alert record does not create one.
Keep finding provenance separate from remediation output.
Attach compliance evidence deliberately to the relevant dated occurrence.

Pages for this role.

Next step

Want the walkthrough for your role?

Book a walkthrough and I will show the parts of GAEZLA that matter for your job.

Book a walkthrough