Agents — Paseo Marketplace Docs

Khanoor — Security Operations

Autonomous security triage and response. Khanoor ingests telemetry from any source, correlates multi-signal threats, and investigates incidents end-to-end.

Multi-signal ingestion

Accepts syslog, CEF, JSON, CloudTrail, and Windows Event logs. Normalizes every event into a common schema so disparate sources can be compared and correlated.

Corroborated triage

Combines flow-based heuristics, payload signature matching, and per-source clustering to suppress false positives. Events are scored and ranked by confidence before they ever reach a human analyst.

Automated response

Investigates confirmed incidents autonomously, maps findings to the MITRE ATT&CK framework, and executes containment actions — from IP blocking to host isolation — with full audit logging.

Honest scope. Khanoor's ranked-triage queue shines on multi-signal loud attackers (e.g., sustained reconnaissance) and is designed to degrade gracefully on single-signal events that fall within normal population ranges. Read the coverage spec before claiming detection boundaries.

API endpoints

Endpoint	Does
post`/api/v1/agents/khanoor/event`	Triage a single security event and return classified alerts with MITRE mappings.
post`/api/v1/agents/khanoor/batch`	Process a batch of events, returning alerts, correlated incidents, and any containment actions taken.

Resolve — Customer Support

Autonomous Tier-1 and Tier-2 customer support. Resolve classifies intent, retrieves relevant knowledge, drafts contextual responses, and escalates complex cases with full context.

Intent classification

Classifies every incoming ticket into one of ten intent categories (billing, technical, feature request, cancellation, etc.) with confidence scoring and sentiment analysis.

Retrieval-grounded answers

Retrieves relevant knowledge articles and past resolutions from a per-tenant index. Responses are grounded in your organization's actual documentation, not generic training data.

Smart escalation

When confidence is low, sentiment is strongly negative, or the customer is high-value, Resolve packages the full context — classification, knowledge retrieved, draft response, and reasons — and escalates to your existing ticketing system.

Two construction paths. Resolve runs in a lightweight mode (no model load, template-based responses) for testing and fallback, and a full mode with embeddings-based retrieval and LLM-generated responses for production. The production path requires per-tenant scoping.

API endpoints

Endpoint	Does
post`/api/v1/agents/resolve/ticket`	Process a support ticket and return either a resolved response or an escalation package.

DocFlow — Document Processing

Intelligent document understanding. DocFlow extracts structured data from PDFs, Word documents, images, and scans — with OCR in 163+ languages and a cryptographically-signed audit trail for every document.

Universal ingestion

Processes PDF, DOCX, PNG, JPG, TIFF, TXT, and CSV. OCR supports 163+ languages including Simplified and Traditional Chinese, Arabic, Persian, Japanese, and all major European scripts.

Hybrid extraction

Combines fast deterministic extraction (dates, amounts, emails, phone numbers) with machine-learning entity recognition (people, organizations) for comprehensive structured output.

Verifiable audit trail

Every processed document emits a cryptographically-signed audit receipt. The receipt includes the document hash, page count, processing latency, and timestamp — independently verifiable without trusting the gateway.

Language selection. DocFlow defaults to a focused set of scripts for OCR, but any installed language pack can be selected per-document via metadata. No reconfiguration of the agent is required.

API endpoints

Endpoint	Does
post`/api/v1/agents/docflow/document`	Process a single document and return extracted entities, classification, tables, routing decision, and audit receipt.

At a glance

Capability	Khanoor	Resolve	DocFlow
Primary use case	Security operations	Customer support	Document processing
Input	Security telemetry	Support tickets	Documents (PDF, DOCX, images)
Output	Alerts, incidents, containment actions	Resolved responses or escalation packages	Entities, classification, tables, audit receipt
Multi-language	Log-text analysis (any UTF-8)	English, Arabic, Spanish, French, German, Chinese (Simplified & Traditional)	OCR in 163+ languages
Verifiable receipts	PoTE on every invocation	PoTE on every invocation	PoTE + cryptographically-signed audit receipt
Escalation path	Automated containment with approval gates	Context-rich escalation to ticketing systems	Routing rules to downstream systems

All three agents implement the same paseo_sdk::Agent trait, run distributed across the fleet, checkpoint state for migration, and emit telemetry for observability. Every successful invocation can return a post-quantum-signed Proof-of-Task-Execution (PoTE) receipt.