The AI analyst

Detection does not depend on it

Alerts are raised by rules, fileless heuristics, behavioural baselines and kill-chain correlation. The language model explains what those layers found. Switch the model off and detection carries on unchanged.

Which model answers

On your own server the model runs beside the platform, in its own service, chosen at installation for the server: a 7B model with an NVIDIA GPU of 6 GB or more, or with 16 GB of memory; a 3B model with 8 GB; none below that. On a GPU an answer takes seconds; on the processor it takes much longer, and the platform waits up to 90 seconds with a GPU, 240 without, before answering without the model. See Requirements.

In Legit AI’s cloud no model runs yet: analyses are built without one and marked FALLBACK.

Without a model, answers are built from rules and the alert’s own facts.

A platform set to find a model by itself tries the local model first, then Anthropic or OpenAI — only if a key for them was configured at your request, and never on an air-gapped deployment. A cloud provider is tried only when no local model answers, so alert data leaves your network only if you configured a cloud key and your local model is down.

On an alert

The AI Analysis tab of an alert holds the analyst’s reading of it: what the attack is likely to be, its MITRE ATT&CK techniques and kill-chain stage, how urgent it is, its likely blast radius, the probability it is a false positive, recommended actions and hunting queries.

The tab is marked LIVE when a model wrote it and FALLBACK when it was built without one. Press R in the queue to run the analysis again — after starting a model, for example.

Cipher

Cipher, in the sidebar, is the analyst you talk to. It reads your tenant’s alerts and investigations to answer, and it can propose actions. What it may propose is a fixed list, and every parameter is checked against that list’s rules:

• an action name it invents is rejected;
• an alert it refers to must be one your tenant can see now, whatever the model claims;
• enriching an indicator, updating an alert, blocking a domain, sending a Slack, email or PagerDuty notification and opening a Jira ticket run when you click them;
• isolating a host, blocking an IP address, ending a process, quarantining a file, revoking a session, rotating credentials and collecting forensics wait for an ADMIN’s approval, and then run as a dry run only. To act on a machine for real, use the response actions described in Isolation and process kill.

Elsewhere

• Investigations → Explain: the platform assembles the facts from the board; the model only phrases them. With no model, you get the facts. See Investigations.
• Executive summary of an investigation, for people outside the SOC.
• Plain-language explanations of a file scan or a packet capture.