Documentation menu
Overview
Getting started
Platform
Partners
Security
Docs / Platform
AI analyst
The kymeer AI analyst is advisory. It explains incidents and drafts playbooks; no data reaches an external model until egress is switched on.
The kymeer AI analyst is advisory: it explains what it sees, recommends next steps and drafts playbooks, and people decide what happens next. External AI egress is off by default, so no data reaches an outside model until an administrator turns it on.
Which models can it use?
| Option | Notes |
|---|---|
| Local model | Any OpenAI-compatible server, such as Ollama, vLLM or llama.cpp. Calls to a loopback or private address are recorded as zero-egress. |
| Anthropic | Your own API key |
| OpenAI | Your own API key |
| OpenRouter | Your own API key |
| Unoblox (unoblox.ai) | Selected for the whole platform by a kymeer platform administrator, so no tenant key is needed. Calls go to api.unoblox.ai and pass the same egress gate and masking as every other provider. |
Anthropic, OpenAI and OpenRouter keys are stored per tenant, encrypted with AES-256-GCM, and never returned by the API. Only a platform administrator can set or revoke them.
What happens on every call?
Every request to a model passes four steps, in this order:
- Egress gate. Off by default. If the setting cannot be read, the gate stays closed.
- Masking. Built-in masking always runs and cannot be switched off. Before the request leaves, kymeer replaces each IP address, MAC address, hostname, email address and user name it recognises with a numbered stand-in, such as IP_1, HOST_2 or USER_3. The same value gets the same stand-in everywhere in the call: in the prompt, in tool calls and in tool results. Values that match your own redaction rules are masked as well.
- Rate limit. Each tenant has a token budget; a request over budget is refused before it is sent.
- Audit. Every attempt, including blocked ones, is recorded with the provider, model, token counts, tenant, time, number of masked values and outcome. The API key is never recorded.
When the answer comes back, kymeer puts the real values back in place of the stand-ins before anyone sees it, so search filters, citations and evidence links still point at your real hosts and users. The list that links stand-ins to real values stays in memory for that one call and is never stored or logged. If the model returns a stand-in that kymeer did not issue, it is left as written and flagged, never guessed.
How do I switch AI off?
AI egress is controlled by one platform setting held by the platform administrator. A change takes effect within 60 seconds, with no restart.
Does it show its evidence?
Yes. In incident analysis, only citations the model selects from the evidence it was given are kept, and claims without a citation are rejected.
Can it write playbooks and rules?
- Playbooks. The analyst can draft a playbook from a prompt. The draft is returned unsaved, any step that names an unknown action is dropped, and a person edits and saves it.
- Detection rules. A proposed rule, including one drafted by AI, is backtested against your tenant's recent events with the same engine that runs in production. It stays inactive until a person approves it.