SkyOps

Devices running an unsupported OS, or one going unsupported within two quarters, grouped by client.

Built for account managers: a replacement and refresh conversation, not a patching one. Live fleet: 26 devices out of support (24 Windows 10, 294 days past; 2 Server 2012 R2, 1,029 days past) and 2 approaching. Classification comes from an OS lifecycle table in config, deliberately NOT ConnectSecure's own is_deprecated flag — that returns zero assets for this tenant, so a report trusting it would have shown a clean fleet.

Unsupported applications across the fleet, grouped into product families.

The vendor emits one entry per installed component, so 158 devices produce 139 near-duplicate 'products' — and the findings that matter (Office 2019, Silverlight, Access 2010, SQL Server 2012 Native Client) sit at the bottom with a count of 1. Grouped into 15 families they become visible. Counts are distinct machines, not component installs.

Claude-powered troubleshooting chat embedded in the HaloPSA client portal.

Anonymous and ticket-anchored: every conversation is tied to a Halo ticket and survives a reboot or a closed tab, with per-turn hidden notes keeping the ticket current even if a session is interrupted. Artie can troubleshoot, open a ticket, check on one, and resolve one. Ticket creation is deferred to the user's first message so there are no ghost tickets. Safety is enforced in code: a category blocklist forces escalation-only for security and phishing categories regardless of what the model decides.

Checks each tenant's Intune actually deploys the ImmyBot agent to newly enrolled devices.

Detects by script CONTENT rather than name, because names are inconsistent across clients and a name match produces false 'missing' results. Flags a pinned installer, wrong Immy instance, bad run-as or signature settings, and unassigned scripts. A tenant without consent reads as 'unavailable', never 'missing' — a permission gap must not look like an undeployed agent.

Printable client-facing quarterly business review.

Pulls licensed users, managed endpoints, RMM patching, security baseline, DNS health and conversation items into one document. The account manager curates section visibility before printing; auto-named PDF on print.

Nightly Collect → Transform → Writeback producing a canonical per-device record.

Five sources today — ScreenConnect, Huntress, ImmyBot, Entra and CyberDrain — joined on serial number, with writeback to Halo. Feeds Unified Assets, Managed Endpoints, ScreenConnect Assets and ImmyBot RMM.

Findings become deduped Halo tickets, with suppression.

A detector registry runs per tenant; each finding produces a ticket keyed on findingType plus resourceId, so a repeat scan updates rather than re-opens. Suppression and per-tenant caps bound the blast radius. Detectors today: EDR coverage gaps, stale users, DNS health.

Tenant overview, coverage gap detection, per-device drill-down and a standalone patch report.

Bulk sub-org provisioning, baseline policy, and per-tenant traffic and threat reporting.

A signed PandaDoc proposal auto-creates a SkyOps project; phases, time and audit follow it through to archive.

Idempotent webhook creates a draft with contract total and recipients. Admin links it to a tenant and a Halo master ticket; templated phase libraries instantiate rows. Time tracked in Halo aggregates back into the project view.

Onboard a client and manage per-vendor mappings — Halo client/site, Huntress org, ScreenConnect group, ImmyBot tenant, DNSFilter org, ConnectSecure company.

Employee records, mileage, expense reports with receipt upload and signed-URL viewing.

User, group, mailbox and licence operations — read-only in production.

Read paths are live. Write paths exist and are exercised on the staging slot against a developer tenant, but production cannot perform them: the prod Entra app holds read-only Graph permissions and the code enforces the same posture independently.

Fleet-wide critical and high CVEs, ranked by exploit likelihood rather than severity alone.

Ranking combines severity with EPSS exploit probability, so a widely-exploited High outranks a Critical nobody is attacking. On the live fleet the top finding is CVE-2023-44487 (HTTP/2 Rapid Reset, EPSS 1.0) and CVE-2024-1709 — the ScreenConnect auth bypass — both of which a severity-only sort buries under 481 Criticals. 6,016 Critical/High CVEs; 149 urgent. Scopes to one client via the tenant selector, and each row opens a drawer showing affected devices and the software to update. Server-side severity filtering keeps the whole thing inside ConnectSecure's 300 requests/minute limit.

Every tenant-mutating action writes an append-only audit row; 7-year retention target for HIPAA/SEC clients.