Multi-Agent Sessions

Cross-System Diagnostics

Query multiple agents simultaneously and correlate findings across your fleet for distributed application failures, load balancing issues, and fleet-wide problems.

Starting a Multi-Agent Session

  1. Click Multi-Agent Session on the Agents page
  2. Agent selection grid appears: online agents have checkboxes, offline agents are grayed out
  3. Select All / Deselect All buttons for quick selection
  4. Environment Filter dropdown: show only Production, Staging, or Development agents
  5. Click Start Session — ETW collection begins on all selected agents

Query Distribution & Responses

Queries distribute to all selected agents in parallel (1 query per agent per question).

Agent Status Sidebar

  • Green — Responding / completed
  • Yellow — Waiting for response
  • Red — Failed or timed out

Use the Agent View Selector to filter chat by specific agent or view all. Skip Waiting Agents to proceed without slow responders.

Cross-Correlation Analysis

After agents respond, click Run Correlation for cloud-side analysis that compares findings across agents:

  • Common Patterns: Issues appearing across multiple systems
  • Outlier Behavior: Agents behaving differently from the fleet
  • Shared Root Causes: Underlying issues affecting multiple systems
  • Environmental Correlations: Patterns tied to specific environments

Auto-Correlate: Toggle to automatically run correlation after each query round.

Export Results: Download the full session transcript with all queries, responses, and correlations.

Query Cost

1 query per agent per question + 1 per device for correlation. Example: querying 5 agents with correlation = 10 queries.

Automated Troubleshooting Across Hosts

The multi-agent session modal has an Automated Troubleshooting tab. Select a ticket or describe the issue and click Start investigation. The AI investigates across every host in the session, proposing one command at a time and naming the host it will run on. You approve, edit, skip or stop each proposed command before it runs.

  • Host context: the AI receives each host's current health, posture, hardware, recent detections and inflections, and its last completed runs, in the same way as single-host Automated Troubleshooting.
  • Step limit: 25 planner calls per host. The run may make 25 times the number of hosts in all, and each host can be the target of at most 25 proposals. When a host has used its share, the AI is told to pick another host or finish. At the limit the run moves to its summary.
  • Interrupted and timed-out runs: a run that stops because the server restarted ends with “Investigation interrupted (server restart).” and one that makes no progress for 35 minutes ends with “Investigation timed out.” Click New investigation to start again.

Fleet Tools

Fleet Tools is a unified multi-agent operations modal for executing approved scripts and transferring files across many agents at once, without opening individual sessions.

Agent Selection & Filtering

  • Visual agent grid with online/offline status indicators and tag display
  • Select individual agents or use Select All / Deselect All for quick bulk selection
  • Filter builder with AND/OR logic across Agent Name, Environment, Tags, Agent Type, and Status fields

Shell Tab

  • Broadcast PowerShell or CMD commands to all selected agents simultaneously, or target a single agent
  • Run As SYSTEM toggle for elevated execution
  • Live output console with color-coded stdout, stderr, and system messages per agent
  • Copy on select, text size, and full screen work the same way as in the Live Session Shell tab.

Files Tab

  • Pull: Request a file from a specific agent by path; Download button appears on completion
  • Push: Upload a file to a specific agent, or select Push to All Selected to broadcast to all agents simultaneously — the file is read once and distributed in parallel
  • Transfer history is automatically cleared when Fleet Tools is closed

Common Scenarios

  • Distributed App Failures: Select web, app, and database tier agents to trace requests and find the failing tier
  • Load Balanced Services: Select all pool members to identify the problematic server and detect configuration drift
  • Active Directory Issues: Correlate authentication events across domain controllers
  • Security Incidents: Track lateral movement and coordinated attacks across systems
  • Performance Comparison: Compare metrics across identical servers to find outliers