THE FIELD GUIDE / SECURITY & RESPONSE
AI assistance & diagnostics
Explained scores, evidence-led investigations and visible run history.
Configure the integration
Open Settings → AI & models to test named connections, choose compatible models per feature and configure budgets. See provider routing. Enable investigations and update importance separately. Core monitoring and patching do not require an AI provider.
Understand importance
Pending updates receive a 0–100 advisory score with an expandable explanation, limitations, model and assessment time. Assessments bind to the exact installed and candidate versions and policy evidence. Scores do not silently change patch priority or schedule.
Retain installed-version assessments
Installed packages can show earlier update-importance assessments whose candidate matches the installed version, separately from any new pending-update score. Historical labels retain source/target versions, rationale and assessment time. They are past importance estimates, not a current malware or vulnerability verdict.
Investigate with evidence
Two-stage triage uses bounded evidence categories, behavioral and threat-intelligence correlation, and explicit uncertainty. Release-plan assistance compares configuration text with vendor defaults. Incident proposals bind to evidence revisions so changed evidence requires review again.
Control AI for each server
Use the persistent AI integration panel on any server tab to pause or resume host-scoped AI with an audited reason. Paused servers are excluded from triage, importance scoring, response proposals and release-configuration provider requests. Non-AI work and historical results remain available. Read the per-server AI control guide.
Throughput, spending and reuse
Run independent triage tasks concurrently with bounded parallel execution, choose rate throttling, a daily cap or unthrottled admission, and reuse exact-match known-good assessments without another provider call. Required evidence, configured model/reasoning and response authorization stay intact.
Find out why a run failed
AI activity retains redacted stages, outcomes, usage, estimated cost, worker health, queue age, stage timings and classified backoff diagnostics. Open a run to inspect its failure stage, then use bounded manual retry where allowed. Configuration and selected evidence are sent to the configured provider; review sensitive content before enabling assistance.
Open the application reference for capability scope and technical details.
Open Open AI_AND_PACKAGE_HISTORY.md on GitHub ↗