Ask AI

Ask AI is the home page and part of every edition; while unactivated it counts against the daily quota.

From question to result

1. Understand: time range, grouping, which Ariel functions apply (LOGSOURCENAME(), QIDNAME(), CATEGORYNAME() and so on). Events versus flows is the toggle left of the input, never guessed.
2. Generate AQL: the read-only check allows a single SELECT … FROM events|flows, adds LIMIT and a time window, and checks the log-source whitelist; then a search is created on Ariel and cancelled at once. A 422 from the Console is fed back to the model for one repair round.
3. Execute: create → poll → results, one flat table. The card header shows the source, hit count or number of aggregate rows, elapsed time, token usage, and the model's own confidence in the query: high is safe to use, medium means open the AQL and check, low usually needs a different question.

Progress shows "Understand → Generate AQL → Run on events"; a reasoning model's thinking is folded under "AI is thinking".

Input

The home page offers six starter categories (Are we under attack / Anything abnormal / Are assets at risk / Any account compromised / Anyone working at night / Is log ingest healthy), four ready questions each; clicking one sends it. Saved queries sit under "My saved".

• Source: events / flows toggle, default events. Switch to flows for bytes, destination ports, internal-to-external traffic.
• Time range: default "all time" (in practice RST_AQL_DEFAULT_WINDOW_MINUTES, 60 minutes). With a range picked, "last hour" in the question is intersected with it and the card says whether the filter was synced, replaced the question's time, or sits inside it.
• Enter sends, Shift+Enter breaks the line.

Results

With a whitelist configured, what you see is the statement as executed: an AQL that named no log source has LOGSOURCENAME(logsourceid) IN (...) appended.

Below the result: "Explain these results" asks the model for a summary; "Send to triage" hands the rows to Triage; 👍 / 👎 feed the learning store, and 👎 can carry the correct AQL so the next similar question follows it.

Empty results

Ariel simply omits log sources outside the whitelist or the security profile; there is no "permission denied", so zero rows cannot tell "no data" from "not visible". The gateway shows one hint (window too narrow, log-source name spelled differently from the Console, no such QID) and a "Widen to the last 7 days and ask again" button. Beyond that, open the AQL and check the literal LOGSOURCENAME() / QIDNAME() values, or review the security profile under Token permissions.

Follow-up turns

Keep asking in the same conversation and the model carries the previous context: same source, references like "the top one" or "that IP" resolve. For a new topic click "New conversation" top-right.

Conversations live on the gateway (copilot.db, expiring after RST_CONVERSATION_TTL_DAYS, 7 days idle) and can be resumed from another browser. The conversation dropdown top-left lists history, with badges for last failed / interrupted / generating.

Timeouts

• No first token within 45 s aborts the request with a retry prompt (RST_LLM_FIRST_TOKEN_TIMEOUT_S, 0 = none). Usually model-side congestion; if it keeps happening, lower that provider's reasoning effort in AI settings or switch provider.
• An Ariel search running past RST_AQL_TIMEOUT_SECONDS (120 s) is cancelled and reported as qradar_timeout. Narrow the window or add a log-source condition so Ariel scans less.

Masking

Content is masked before it reaches the model according to the mode in Settings: cloud replaces IPs, accounts and similar with placeholders (10.30.x.x in the result), private relaxes that, air-gapped sends nothing outside. All three modes are in every edition. Masking applies only to what goes to the model; the table shows the values Ariel returned.