Skip to main content

AI and local LLM

AI analysis, the assistant and report drafting all need a language model. It can be a local server on your network or a cloud provider. The install and model choices are on Local LLM & AI Setup; this page covers what the appliance requires of the endpoint and who may approve it.

A local model runs on a separate host

  • The appliance is sealed. Ollama, LM Studio, llama.cpp server, litellm or any OpenAI-compatible server runs on another machine on your network, ideally one with a GPU.
  • Point the appliance at it under Settings > LLM Providers (needs Change appliance settings, Admin by default) using the host's address, not localhost.
  • If you use an outbound proxy, nothing extra is needed for a host on a private address: the private ranges are always bypassed.
  • Saving the endpoint only checks the URL against the policy below. The card's status check and its test button probe the endpoint with a 3-second timeout, do not follow redirects, and read at most a bounded model list from it. A failure answers with one of a fixed set of reasons, never with text from the remote server.

Cloud providers

  • Anthropic, Google Gemini, OpenAI, Kimi (Moonshot) and GLM (Z.ai). Each has an enable switch, an API key, a default model and a test button.
  • Two consent switches per provider: Allow Cloud Inference and Allow Sensitive Data. Until the first is on, the provider is listed but not used. While the second is off and CICADA detects personal data in a request, the whole request is sent to the local model instead of that provider; with no local model configured it fails. Nothing is redacted.
  • Each provider card shows a status: Ready; Disabled; API Key Required; Cloud Inference Disabled; Not Purchased (enable on the Features or License page); Live Test Required; Unavailable(check the configuration); or Model Approval Required.
  • What a cloud provider is sent: the analyst's question and the event rows it names (rows whose actor or target is a host, user, address or hash in the question), each with its Evidence ID, and nothing else about the investigation. The investigation name, scope, IOC records, MITRE list, timeline feed and response actions stay on the appliance. Case Narrative AI enhance sends the section text being rewritten and one line per detection behind it. A local model gets the full investigation context.
  • Keys are stored encrypted and are never returned by the API; the card only shows whether a key is set.
  • Outbound HTTPS to the provider is listed on Network Requirements.

The endpoint policy

An inference endpoint URL is accepted only when all of these hold:

  • It is http or https with a hostname, and carries no username, password, query string or fragment.
  • A remote endpoint must be https. Plain http is allowed only for a literal loopback, private or link-local address (for example http://192.0.2.10:11434) that you mark as local.

The same policy guards the status probe, so nobody who can change settings can make the appliance send a request to an arbitrary host by typing it into the Ollama URL field.

Model approval (attestation)

A local or OpenAI-compatible model, and the Kimi and GLM cloud providers, are not used for analysis until someone with Change appliance settings (Admin by default) has approved the model identity the appliance can see at that endpoint. The provider card reads Model Approval Required until then, and the AI assistant refuses the request with a 409 rather than answering from an unapproved model.

  • Approval probes the endpoint, checks the configured model is one it advertises (or that the server accepts any model name), and records the provider, a hash of the endpoint, the model name, the runtime identity the server reported, who approved it and when.
  • Changing the endpoint or the model invalidates the approval; approve again.
  • Each approval writes an ai_model_attested event to the security audit log. The record never contains a key or the endpoint URL in clear.
  • Anthropic, Google and OpenAI are treated as official endpoints and do not need this step.

Next