Skip to main content

IT Fleet Intelligence

IT fleet intelligence is knowing what is happening on every device you manage, and what happened on any of them at any earlier moment, without logging in to one.

The SparkLogs Agent gives every device a time machine. It keeps a continuous record of events, crashes, changes, services, performance and network, so you can rewind to the minute a problem started and see what changed before it.

Engineers collaborate over this data with an AI partner. SparkLogs makes this possible in two ways:

  • It prepares and stores the fleet-wide record. Every event is curated, graded by severity and grouped into patterns.
  • It gives the AI query tools built for that record. They can count and trend events, compare devices, and read any device's state at any moment, across billions of data points in seconds.

The AI explores and analyzes the record, following each finding to the next question, and brings back what matters with the evidence attached. Engineers skip the tedious fact gathering and spend their time on the decision and the fix.

Together they can:

  • Work a hard ticket from evidence, such as a backup that fails with an unhelpful error code. Paste the ticket and get what the machine recorded around it, with citations. See Agentic RCA.
  • Start each day knowing what needs a person, across every client or site, including problems that no alert rule covers.
  • Find every machine a problem affects before those users call. See Fleet-wide questions.
  • See what changed before something broke: a driver, an update, a setting, a service. See Device timeline.
  • Check that every machine is set up the way it should be, such as backup and endpoint protection installed and running.

Every answer links to the data behind it, so the engineer stays the one who decides.

Rules-based alerting fires when a condition someone defined is met. It looks at one device at one moment, without its history or what is happening on other machines. IT fleet intelligence adds that context: the same question can weigh a device's past, the changes before a failure, and every other device you manage.

Ask a question​

With your AI connected, ask in plain language.

  • "Why did this file server reboot at 2am?"
  • "Backups on this client have failed three nights running. What changed?"
  • "This server crawls every afternoon. What is it doing?"
  • "Who ran PowerShell on this box yesterday, and what did it touch?"
  • "How many endpoints at this client saw account lockouts today?"
  • "Alice's account was compromised yesterday at 3:32pm. What did it reach afterwards?"
  • "What is failing across my fleet today that was not failing last week?"

Ask follow-up questions. Each answer builds on the last, and you can go as deep as the ticket needs.

An answer links to the device at the moment it describes, and the app can copy what you are looking at back to the AI as a prompt. See Your AI and the app.

To ask about many devices at once, see Fleet-wide questions.

Get a written report​

The SparkLogs AI plugin for Claude, Cursor and Codex comes with skills, which are instructions the AI follows for a specific job. Two of them turn a conversation into a document for the ticket. Ask for one by name, for example "use sparklogs-investigate on SRV-FILE01 this week".

SkillWhat it writes
sparklogs-investigateA cited report of what was observed on the device in the time window, with links you can open in Explore and a list of what it could not see.
sparklogs-analyze-causeCandidate causes drawn from that report, each with what would confirm it or rule it out.

Run sparklogs-investigate whenever you want the write-up, whether or not the question was hard. An investigation is multi-step: the AI decides what to look at next from what it just found. See Agentic RCA.

Two ways to connect your AI​

Works withUse it when
Skills pluginClaude, Cursor and Codex. It follows the agentskills.io standard.You want to ask, investigate and write up a ticket inside the tool you already work in.
MCPMicrosoft Copilot Studio, and any agent or automation that supports MCP.You build your own agents, for example ones that already use your PSA and RMM.

Both sign in with OAuth. A custom MCP agent also needs the instruction template. See Connect your AI.

Check what an answer is based on​

An error in a log usually tells you the symptom. The cause is often something no log line states: the disk was nearly full when the job ran, a VSS writer had already failed, something was installed that morning, or memory had been climbing for a week. The agent records that state along with the logs, which is how an answer can point to it.

When you read any AI answer, ask what data it looked at. Here each claim cites the query behind it, and an investigation report lists what it could not see. That is what lets you put the answer on a ticket and stand behind it with a client. Learn about our commitment to accurate, verifiable AI in our AI Trust Principles.

FAQ​

Next steps​