Shyft AI Hub · Collaborative & Conservative AI

Orchestrate your whole data platform and data — just by asking and as a team.

Shyft AI Hub is the conversational layer over the Shyft platform — Agents, Streamz, Analyzer, Store, and Search — and over your data wherever it lives: object stores, Splunk, Databricks, Snowflake, and more. Ask in plain English and the Hub coordinates it all: it plans the work, writes the query, runs it, and explains the result — with a confidence score on every step, the query shown before it runs, and your whole team in one shared, auditable thread.

ORCHESTRATES 5 components CONFIDENCE-SCORED answers HUMAN-IN-THE-LOOP by design SHARED investigations
01One platform, one conversation

The AI Hub orchestrates every Shyft component — and all your data.

You don't wire the pipeline by hand. Ask the Hub, and it coordinates Agents, Streamz, Analyzer, Store, and Search — and reaches your data wherever it lives, from object stores to Splunk, Databricks, and Snowflake.

SH"show successful logins from 185.220.101.47 in the last hour"
Shyft AI Hub ORCHESTRATION
Understands intent · plans the work · generates ShyftQL · runs the right components · explains the result · keeps you in the loop.
↓ ORCHESTRATES EVERY STAGE OF THE PIPELINE ↓

↳ AND READS YOUR DATA WHEREVER IT LIVES

Object stores Splunk Databricks Snowflake …and more
02From question to answer

Five clear steps, every time.

A calm, predictable path from a plain-English question to a shared, trustworthy result.

Ask
Draft
Review
Run
Share
STEP 01 — ASK

Ask in plain English

No query language required. Describe what you want to know, the way you'd ask a teammate.

give me a count of all events in logs_paloalto in the last 2 days
STEP 02 — DRAFT

Shyft drafts the query

Your intent becomes a real, readable Shyft query — with a match score that shows how well it understood you.

GENERATED QUERY 98% MATCH
dataset logs_paloalto | summarize Count=count()
STEP 03 — REVIEW

You review with full context

See the exact query and how confident Shyft is — long before a single row is touched.

98% confidence
Query understood · ready for your approval
STEP 04 — RUN

You approve, it runs

The human stays in the loop. One click executes the query — and the run is logged with its own ID.

Run QueryCOMPLETE
EVENTTIMECOUNTDBUUID
1780208300328,314,604summarize
STEP 05 — SHARE

Share, milestone, hand off

Bring the team in, mark what matters, and pass it on — with the full thread and context intact.

PAMR
Milestone added · shared with team
03Natural language → Shyft query

Type a question. Get a real query you can read and run.

Shyft translates intent into the Shyft query language and shows you exactly what it will execute — always transparent. You review, then press Run.

Reads your schema

Resolves datasets, fields, and time windows from the question itself.

Shows the generated query

A match score tells you how well it understood, before a single row is touched.

Run, or open in Search

Execute inline for a quick preview, or hand off to the full Search workspace.

SHYFT AI
GENERATED QUERY 98% MATCH
dataset logs_paloalto | summarize Count=count()
Run QueryOpen in Search
RUN PREVIEW · STATUS COMPLETE
EVENTTIMECOUNTDBUUID
1780208300328,314,604summarize
Showing 1 of 1 rows
04Conservative by design

When it's unsure, it asks first.

Every answer wears its confidence openly. When Shyft needs a little more to be sure, it says so plainly and asks for exactly what it needs — so you always know where things stand.

Confidence on every answer

A clear score — 30%, 98%, 100% — sets expectations right up front.

Friendly flags, early

If a dependable query needs one more detail, Shyft surfaces it right away.

Clarifications, not assumptions

It asks one precise question, so the answer is exactly what you meant.

SHYFT AI · HUB RESPONSE30% CONFIDENCE
To count all events in logs_paloalto for the last 2 days, I'd like to know at least one available field. None are provided yet — happy to count every row instead, just say the word.
MESSAGE CONTEXT
DATASET logs_paloalto
HEADS-UP

One field would let me build a precise count query for 'logs_paloalto'.

CLARIFICATION
Can you share the available fields for 'logs_paloalto', or shall I count all rows for you?
05Accountable by default

Every step on the record, and easy to revisit.

Each run is a tracked execution with an action, a unique ID, and a linked search job you can open. Everything's on the record — and Shyft explains, in plain English, what each query did.

System execution log

Action, status, and a UUID for every run — completed work traces back to its source.

Inspect the search job

Jump straight from the thread to the underlying job in Search.

Milestones & drafts

Mark key moments and save drafts to return to — the investigation remembers.

SYSTEM EXECUTION
run_query
COMPLETE
ACTION
run_query
ID
e5b26f58-d0cb-4398-9937-908db23303c2
Inspect Search Job
MESSAGE CONTEXT
DATASET logs_paloalto QUERY summarize Count=count()
This query selects all data from 'logs_paloalto' and uses summarize to count all rows, producing a single output column 'Count' — the total number of events.
06Collaborative by default

One thread. Your whole team, with the right access.

Investigations are shared, live spaces. Bring colleagues in as Editors who can chat and run actions, or Viewers with read-only access — the owner stays in control.

Editor & Viewer roles

Editors chat and run actions; Viewers observe. Access granted per conversation.

Live presence

See who's in the thread in real time — just you, or your team right beside you.

Share & hand off

Pass a full, contextual investigation to the next analyst, with nothing lost.

07In the room together

See how teams work together.

Two real investigations — a security alert and a latency spike — where people and Shyft work the data side by side.

SECURITY

Contain a brute-force alert

CRITICAL Threshold · 185.220.101.47
LIVE · 3 HERE
PAMR
PA
Priya AnandOWNERSOC Analyst
Shyft opened this off the critical alert. Let's confirm scope first — pull all events from 185.220.101.47 in the last 60 minutes.
Shyft AIHUB RESPONSE98% MATCH
Here's the query for every event from that source in the last hour.
dataset firewall | where src_ip == "185.220.101.47" | sort by eventtime desc | limit 100
412 events · 1 source IP
MR
Marcus ReyesEDITORjoined · Incident Lead
Did any of those attempts actually succeed? That's what decides our response.
Shyft AIHUB RESPONSE100% CONFIDENCE
Filtering the same source for successful authentications.
dataset firewall | where src_ip == "185.220.101.47" and event_type == "successful_auth"
0 successful logins — all 412 attempts failed
PA
Priya AnandOWNER
Clean — no breach. Adding a milestone and handing the IP block to Marcus.
Milestone · Confirmed no successful auth — IP queued for block

OBSERVABILITY

Trace a latency spike

Checkout p99 latency · 14:20 spike
LIVE · 3 HERE
DCLO
DC
Dana ChoOWNERSRE
p99 on checkout jumped at 14:20. Shyft — count errors in logs_checkout over the last 2 days, grouped by status.
Shyft AIHUB RESPONSE34% CONFIDENCE
Happy to — one quick check first. logs_checkout has two status-like fields: http_status and app_status. Which should I group by? CLARIFICATION NEEDED
DC
Dana ChoOWNER
http_status — we're chasing 5xx errors.
Shyft AIHUB RESPONSE96% MATCH
Grouping 5xx errors by http_status in 5-minute bins across the last 2 days.
dataset logs_checkout | where http_status >= 500 | summarize Count=count() by http_status, bin(eventtime, 5m)
503s rose 18× at 14:20
LO
Leo OrtizVIEWERjoined · Backend Eng
That lines up with the payments deploy at 14:18. Likely the culprit.
DC
Dana ChoOWNER
Great catch. Saving this as a draft so it's ready for the postmortem.
Draft saved · "checkout-503-spike" for postmortem
08Care, measured

Powerful, and trustworthy.

100%
of actions logged with an ID and easy to revisit
queries run before you review and approve them
3
confidence signals — score, match, heads-up — on every turn
2
access roles: Editors who act, Viewers who observe

Powerful AI for your data — thoughtful at every step.

Ask in plain English, see the query, keep the human in the loop, and investigate as a team. Schedule a demo to see Shyft AI Hub on your own data.