AI Providers
The SOC-AI assistant needs an AI provider: the service that runs the language model behind it. UTMStack v12 works with ThreatWinds out of the box and lets you switch to OpenAI, Anthropic, Google Gemini, Groq, Mistral, DeepSeek, Azure OpenAI, a local Ollama server, or any OpenAI-compatible gateway. You choose the provider in Configure > Settings > SOC-AI.
Who can change it
Only users with the socai.write permission ("Configure the SOC AI provider"), which the Administrator role has. Analysts and Viewers cannot open the page.
The default: ThreatWinds
A new installation uses ThreatWinds with no setup:
No API key is needed. The page note reads "Uses your UTMStack license automatically — no API key needed. Billed through your ThreatWinds subscription."
UTMStack creates this configuration by itself as soon as the instance is registered. If the instance is not registered yet, choosing ThreatWinds fails with "instance not registered yet".
In this default, Auto-analyze alerts and Allow managing incidents are off, Max tokens is 4096 and Max tool iterations is 12.
The settings page
The page is titled SOC-AI Configuration and has the sections below. The Authentication section appears only for the Custom provider.
Model & connection
| Field | Notes |
|---|---|
| Provider | "Selects the wire format. Anything other than Anthropic uses the OpenAI-compatible API." |
| Model | Pick a suggested model or Custom model… to type any model identifier your provider offers. |
| API URL | Shown only for Azure OpenAI, Ollama and Custom. |
Authentication
| Field | Notes |
|---|---|
| API key | The key from your provider. For every provider except Custom, this field sits in Model & connection; ThreatWinds and Ollama have none. When a key is stored, the field reads "A key is stored. Leave blank to keep it." |
| Authentication type | Custom provider only: API Key, Bearer, Custom Headers or None. |
| Auth header name | Custom provider with API Key: the header that carries the key. |
| Bearer token | Custom provider with Bearer. |
| Custom headers | Custom provider with Custom Headers: extra headers sent with every request. Values are stored encrypted; * keeps the stored value. |
Alert triage behavior
| Field | Notes |
|---|---|
| Auto-analyze alerts | "Triage incoming alerts in real time." SOC-AI investigates each new alert and writes an assessment. See SOC-AI Assistant. |
| Allow managing incidents | "The triage agent may create or update incidents when it decides an alert warrants one." |
Advanced
| Field | Default | Notes |
|---|---|---|
| Max tokens | 4096 | "Maximum tokens per LLM response." |
| Max tool iterations | 12 | "Cap on the agent's plan -> tool -> observe loop." |
Providers
| Provider | What you enter | Suggested models |
|---|---|---|
| ThreatWinds | Nothing. | Set by UTMStack. |
| OpenAI | Model, API key. | gpt-4o, gpt-4o-mini, gpt-4.1, gpt-4.1-mini, o3, o4-mini |
| Anthropic (Claude) | Model, API key. | claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5-20251001 |
| Google Gemini | Model, API key. | gemini-2.5-pro, gemini-2.5-flash, gemini-2.0-flash |
| Groq | Model, API key. | llama-3.3-70b-versatile, llama-3.1-8b-instant |
| Mistral | Model, API key. | mistral-large-latest, mistral-small-latest |
| DeepSeek | Model, API key. | deepseek-chat, deepseek-reasoner |
| Azure OpenAI | API URL, model, API key. | Free text (your deployment name). |
| Ollama (local) | API URL, model. No key. | Free text. |
| Custom (OpenAI-compatible) | API URL, model, authentication. | Free text. |
Where requests go
The UTMStack server itself calls the provider, so the server needs outgoing HTTPS access (port 443) to the provider's address. Your browser never talks to the provider.
| Provider | Address UTMStack calls |
|---|---|
| ThreatWinds | ThreatWinds' servers, through the instance registration |
| OpenAI | https://api.openai.com/v1/chat/completions |
| Anthropic (Claude) | https://api.anthropic.com/v1/messages |
| Google Gemini | https://generativelanguage.googleapis.com/v1beta/openai/chat/completions |
| Groq | https://api.groq.com/openai/v1/chat/completions |
| Mistral | https://api.mistral.ai/v1/chat/completions |
| DeepSeek | https://api.deepseek.com/chat/completions |
| Azure OpenAI, Ollama, Custom | The API URL you enter |
If your network only allows known destinations, allow the address of the provider you choose. Every provider except Anthropic is called with the OpenAI-compatible request format.
Choosing a model
It must support tool calling (also called function calling). The assistant works by calling UTMStack's tools, and Save configuration refuses a model that does not call a tool when asked to.
Larger models investigate better. The assistant plans several steps and reads search results. Small or very fast models are cheaper but more likely to stop early or misread results.
Context length matters for long conversations. UTMStack shortens a conversation ("Compacting context…") when it nears the model's limit. It knows the limits of Claude and GPT models by their names and assumes 128,000 tokens for other models.
Azure OpenAI
"Paste your full Azure deployment endpoint as the URL; the model is your deployment name. Auth uses the api-key header."
The address has the form:
https://<resource>.openai.azure.com/openai/deployments/<deployment>/chat/completions?api-version=…Ollama (local)
"Point the URL at your Ollama host. No API key is needed for a local instance." For example:
http://localhost:11434/v1/chat/completionsReplace localhost with the address of your Ollama server as the UTMStack server sees it. A local model keeps your alert and log data on your own network.
Custom (OpenAI-compatible)
"Any OpenAI-compatible endpoint. Set the URL, auth and any extra headers your gateway needs." For example https://my-gateway/v1/chat/completions.
Save and test
- 1
Choose the provider and fill in the fields
Pick the provider, the model and, if needed, the address and the key.
- 2
Click Save configuration
UTMStack tests the connection first ("Verifying & saving...") whenever the provider, model, address, key or headers changed. If the test fails, the configuration is not saved. If the provider only answers that you are sending too many requests, the configuration is saved anyway, because the connection itself works.
- 3
Check the assistant
The Ask button appears in the top bar. Ask a simple question, for example "how many open alerts, grouped by adversary?".
Keys and header values are stored encrypted and are never shown again.
What the test checks
Save configuration makes two calls to the provider before it saves: a normal request, and a request that asks the model to call a tool. Each may take up to 90 seconds. If either fails, the page shows the reason and nothing is saved:
| Message contains | Cause | Fix |
|---|---|---|
authentication failed (401) or (403) "check the API key / auth headers" | The key is wrong, expired or has no access to the model. | Create a new key at your provider and paste it. For Custom, check Authentication type and the header name. |
url is required for provider | Azure OpenAI and Custom need an API URL. (With an empty API URL, Ollama falls back to http://localhost:11434/v1/chat/completions.) | Fill in the full address, including the path (for example /v1/chat/completions). |
endpoint unreachable | The UTMStack server cannot reach the address: a wrong host name, a firewall, or localhost used for a server on another machine. | Test from the UTMStack server with curl to the same address. For Ollama, use the address of the Ollama machine as the server sees it. |
LLM check failed (404) | The address or the model name (Azure: the deployment name) is wrong. | Check both against your provider's console. |
tool-calling not supported or model did not return a tool call | The model cannot call tools. | Choose a model that supports tool calling. |
instance not registered yet — cannot use the ThreatWinds provider | The ThreatWinds provider needs the instance registration, which is not complete. | Wait for registration, or choose another provider. |
If the provider only answers that too many requests were sent, the configuration is saved anyway, because the key and address work.
Tenants
On a multi-tenant installation each tenant follows the instance's configuration until it saves its own:
A tenant that follows the instance sees "Following the instance default. Saving here gives this tenant its own configuration."
A tenant with its own settings sees "This tenant has its own configuration." and can click Follow the instance default to go back.
Usage on this page
The page also shows the day's AI allowance when a limit is set ("AI allowance today"). For the instance operator using ThreatWinds, a Usage block shows Chat completions (today) and when the count resets. See AI Usage and Limits.
Related pages
SOC-AI Assistant
AI Usage and Limits