Options
| Option | Data flow |
|---|---|
| Self-hosted model (recommended) | Alert evidence goes to an endpoint you run and stays within your network. |
| Hosted fallback | Used only when the self-hosted endpoint is unavailable, with your own key, to a provider you choose. |
| None | Built-in deterministic triage. |
Any endpoint that speaks the OpenAI chat completions API works: Ollama, vLLM, llama.cpp, LM Studio, or a commercial provider.
Configure
Settings › AI is the place. The environment file can seed the same values at deployment time; changes in the console take effect immediately.
- Enter the self-hosted endpoint URL and model name. Test the connection; the console sends a short synthetic prompt and shows the latency.
- Optionally enter the hosted fallback URL, model and key.
- Set the investigation budget: the maximum number of queries per investigation.
- Set the evidence grade below which verdicts are never automated, regardless of playbook mode.
Choosing a model
Verdicts need a model that follows structured instructions well and handles a few thousand tokens of context. A mid-sized instruction-tuned model on a single GPU serves a small SOC comfortably; measure latency on the alert page and raise capacity if verdicts lag the queue.
Privacy
Evidence sent to the model includes event fields, which can contain personal data. With a self-hosted model that data stays in your deployment. If you configure a hosted provider, add it to your data processing documentation; see Subprocessors for how FluenceSecurity handles this for hosted tenants.
Your data stays yours
Your data is used only to advise on your alerts. The advice improves from your analysts' feedback in the product; see Feedback.