Model setup

Point XenXDR at a self-hosted model, optionally add a hosted fallback, or run with none.

Options

OptionData flow
Self-hosted model (recommended)Alert evidence goes to an endpoint you run and stays within your network.
Hosted fallbackUsed only when the self-hosted endpoint is unavailable, with your own key, to a provider you choose.
NoneBuilt-in deterministic triage.

Any endpoint that speaks the OpenAI chat completions API works: Ollama, vLLM, llama.cpp, LM Studio, or a commercial provider.

Configure

Settings › AI is the place. The environment file can seed the same values at deployment time; changes in the console take effect immediately.

  • Enter the self-hosted endpoint URL and model name. Test the connection; the console sends a short synthetic prompt and shows the latency.
  • Optionally enter the hosted fallback URL, model and key.
  • Set the investigation budget: the maximum number of queries per investigation.
  • Set the evidence grade below which verdicts are never automated, regardless of playbook mode.

Choosing a model

Verdicts need a model that follows structured instructions well and handles a few thousand tokens of context. A mid-sized instruction-tuned model on a single GPU serves a small SOC comfortably; measure latency on the alert page and raise capacity if verdicts lag the queue.

Privacy

Evidence sent to the model includes event fields, which can contain personal data. With a self-hosted model that data stays in your deployment. If you configure a hosted provider, add it to your data processing documentation; see Subprocessors for how FluenceSecurity handles this for hosted tenants.

Your data stays yours

Your data is used only to advise on your alerts. The advice improves from your analysts' feedback in the product; see Feedback.