SOC-AI Assistant

SOC-AI is the AI assistant built into UTMStack v12. You ask it questions in plain language about your alerts, logs and detections, and it can also act for you: update alerts, open incidents, build dashboards and response flows, and more. It can also look at every new alert on its own and write an assessment on it.

Before you start

• An AI provider must be set up in Configure > Settings > SOC-AI. A new installation uses the ThreatWinds provider without any key once the instance is registered. See AI Providers.

• Until a provider is set up, the assistant's buttons are hidden, and AI options such as Using AI for new flows are locked.

• In UTMStack v12.0.2 the assistant is shown only to users who can open the SOC-AI settings, that is the Administrator role. Analysts and Viewers do not see it.

• Each question and each alert analysis counts against the daily AI allowance of your tenant, if one is set. See AI Usage and Limits.

Where you find it

The assistant panel

The panel is titled SOC Assistant. When it is empty it reads "Ask anything about your alerts, detections or the console — I can investigate and act on the SIEM." and suggests a first question, "how many open alerts, grouped by adversary?".

In a long conversation you may see "Compacting context…" while the assistant shortens what it remembers.

Conversations are kept in your browser only. UTMStack does not store them on the server, so they are not shared with colleagues and are gone when you clear them or reload the page.

How it works

The assistant works in a loop: it plans, calls one of UTMStack's tools, looks at the result, and repeats until it can answer. The number of rounds is capped by Max tool iterations in the SOC-AI settings (default 12). The tools are the same ones UTMStack offers to outside AI clients; see MCP Server.

Read-only tools are always available to the assistant, for example log and alert search, SQL queries over logs and alerts, and counts. In a conversation it can also use these groups of tools:

Automatic alert triage

When Auto-analyze alerts is on in the SOC-AI settings, SOC-AI investigates every new alert on its own:

1. It replaces some personal data before the alert goes to the AI: the user names and email addresses of the target and the adversary, and of the target in the alert's last event, become placeholders (see What data goes to the AI provider below).

2. It judges the alert together with the score UTMStack computes for it. Only when that leaves the picture unclear does it investigate further with tools.

3. It writes its assessment as a note on the alert, starting with [AI SOC Agent].

The alert then carries the AI assessed badge, and its details show a SOC AI assessment section with a risk level and a score out of 100.

During triage, SOC-AI may change only alerts. With Allow managing incidents on, it may also create or update incidents when it decides an alert deserves one. It never changes dashboards, compliance, rules, data sources or flows during triage.

On a new installation using the ThreatWinds default, both switches are off.

Analyse one alert on demand

In the alert details, click Generate AI summary ("SOC-AI investigates this alert and adds an assessment."). The request is queued and the assessment is written on the alert when it is ready, usually after about a minute. If it takes longer, you see "The AI summary is taking longer than expected. It will show up on the alert when it is ready."

What data goes to the AI provider

The AI provider you choose in Configure > Settings > SOC-AI receives the data below. Requests go from your UTMStack server straight to the provider's address (listed in AI Providers); with the default ThreatWinds provider they go to ThreatWinds.

What is replaced before sending. For automatic triage and Generate AI summary only, UTMStack replaces these values with placeholders before the alert leaves the server:

• the user name and email address of the alert's target and adversary;

• the user name and email address of the target in the last event (automatic triage only, because only it sends the last event);

• email addresses inside the text values of the last event's log fields (automatic triage only).

The model is told which fields were replaced, so it does not draw conclusions from the placeholders.

What is not replaced. IP addresses, host names, the origin user of the last event, the original log text (raw), the contents of chat messages, and everything that tools return during a chat or a deeper triage are sent as they are.

What is stored where.

• Chat conversations are kept only in your browser.

• Assessments are stored in UTMStack as a note on the alert, starting with [AI SOC Agent]. Everyone who can read the alert can read the note.

• What the provider keeps, and for how long, depends on the provider's own terms.

If your data must not leave your network, run a model on your own infrastructure (Ollama, or any OpenAI-compatible server) and choose it as the provider. See AI Providers.

Permissions

Because the assistant's buttons depend on the settings check, in UTMStack v12.0.2 only users with socai.write see them.

Troubleshooting

Not the same as AI Analyst

Threat Intelligence > AI Analyst is a threat intelligence feature, separate from the SOC-AI assistant. It is described with the threat intelligence pages.

Related pages

• AI Providers

• AI Usage and Limits

• MCP Server

• Building a Flow