Options
| Option | Data flow |
|---|---|
| Self-hosted model (recommended) | Alert evidence goes to an endpoint you run and stays within your network. |
| Hosted fallback | Used only when the self-hosted endpoint is unavailable, with your own key, to a provider you choose. |
| None | Workflows still run; verdicts wait for an analyst. |
Any endpoint that speaks the OpenAI chat completions API works: Ollama, vLLM, llama.cpp, LM Studio, or a commercial provider.
Configure
Configure models in Settings › AI. The environment file can seed the same values at deployment time. Console features switch as soon as you save; playbooks pick up the change within a minute.
- Choose which tier to use: self-hosted first with hosted fallback, self-hosted only, hosted only, or off.
- Enter the self-hosted endpoint URL and model name, and an API key if the endpoint needs one.
- Optionally enter the hosted fallback URL, model and key.
- Save, then select Test. The console sends a short prompt and shows the result and latency.
A model per feature
Under Model per feature you can give any AI feature its own model, or turn AI off for it. Blank fields use the default above. Typical choices: a small, fast model for the log hunt agent, a stronger one for verdicts, and a hosted model only where data may leave your deployment.
| Feature | Where it runs |
|---|---|
| Log hunt agent | Logs page |
| Detection memo drafts | Detections |
| Report drafts | Reports |
| Parser suggestions | Settings › System |
| Advisory verdict | Playbooks |
| Investigation agent | Playbooks |
| Triage notes | Playbooks |
| Shift handover digest | Notifications |
The number of queries an investigation may run is set on the playbook's investigation block, not here.
Choosing a model
Verdicts need a model that follows structured instructions well and handles a few thousand tokens of context. A mid-sized instruction-tuned model on a single GPU serves a small SOC comfortably; measure latency on the alert page and raise capacity if verdicts lag the queue.
Privacy
Evidence sent to the model includes event fields, which can contain personal data. With a self-hosted model that data stays in your deployment. If you configure a hosted provider, add it to your data processing documentation; see Subprocessors for how FluenceSecurity handles this for hosted tenants.
Your data stays yours
Your data is used only to advise on your alerts. The advice improves from your analysts' feedback in the product; see Feedback.