The principle
AI in XenXDR is advisory: it reads, compares, summarises and recommends, and people decide. Its output is recorded with the run that produced it. A playbook acts automatically on an AI verdict only when its step is in auto mode, the verdict is malicious with high confidence, and the organization's guardrails allow it; everything else waits for a person.
Where it appears
| Place | What the AI does |
|---|---|
| Alert page | The advisory verdict (benign, malicious or inconclusive) with confidence, a recommendation and an evidence grade. See Triage verdicts. |
| Playbooks | The investigation block gathers context with bounded read-only queries; the decide step produces the verdict; the summarize block writes a triage note. See Investigation agent. |
| Notifications | The shift handover digest every eight hours. See Notes and reports. |
| Reports | Drafts of empty report sections from the attached material. |
| Logs page | AI Hunt: a hunt theory investigated step by step. See AI Hunt. |
| Detections | How often analysts agreed with the AI on each rule, and a draft triage memo from their feedback. |
| Settings › System | Suggested parsers for events that could not be parsed. |
Your model
The platform talks to any OpenAI-compatible endpoint. Point it at a model on your own hardware and alert evidence stays inside the deployment. Optionally add a hosted fallback with your own key. Without a model, no AI verdict is produced and alerts wait for an analyst. See Model setup.
Better with use
Your analysts' decisions sharpen the advice over time, while people stay in charge of every decision. See Feedback.