AI
AI that quotes the record and waits for your call
AI Insights, summaries, technique and task suggestions, drafts, workflow steps, and charts, on a model you run or contract. Each one says which model answered, and what it suggests waits for an analyst to accept it.
Triage
A verdict you can check against the alert
Run AI Insights on an alert and the model returns a disposition, the fields it quoted, and what it was not shown. You agree, override, or mark the evidence insufficient, and the alert does not change until you act on it.
- Promote to a case, likely benign, or needs an analyst
- Every quote comes from a field the model was shown
- Names what it was not shown, so you know what to check
Triage
A handover note from the alert itself
Generate a triage summary on an alert and the model writes a short note from the alert's title, description, observables, and tags. The card lists what it used and which model wrote it, and says to check it before acting on it.
- Written from this alert only
- Lists the fields and observables it used
- Regenerate it after the alert changes, or dismiss it
Investigation
Techniques wait for your approval
Ask for suggested techniques on a case and the model proposes MITRE ATT&CK techniques. They wait in a review panel, and only the ones you approve are added to the case, each noted as an AI suggestion approved by an analyst.
- Every suggestion starts checked; uncheck what the record does not support
- Approved techniques carry a note that an analyst decided
- Unchecked suggestions stay pending
Investigation
A severity you can keep or apply
Suggest severity puts one level beside the case's current one, with the model that produced it. The case keeps its severity until you apply the suggestion.
- Keep current or apply, from the same dialog
- Shows which model made the suggestion
- Nothing changes until you apply it
Response
Tasks it suggests, tasks you create
A workflow can recommend tasks from the case record. Each has a priority and a reason, and none exists until an analyst creates it. A created task is an ordinary task: assign it, work it, and close it like any other.
- Up to eight suggestions, each with a reason
- Create the ones you want, one at a time
- Shows which model made the list, and when
The record
A draft in the case, not a change to it
Select a passage in the case documentation and ask the writing assistant for an incident summary, an executive update, or a redaction. The draft opens next to the text, and the case changes only when you accept it.
- The editor's /ai block places generated content only when you choose Insert
- A workflow's description draft is shown beside the case: the case description has not changed
- Accept or discard a draft; the passage stays until you do
Workflows
Your own prompt, tested before it runs
A Prompt step sends your instruction to the model, with values from the alert or case inserted where you put them. Ask for text, or for named fields the steps after it can use. Test it on sample values first: the test changes nothing in CaseBender, and shows how long it took and how many tokens it used.
- Start from templates such as Draft an executive update
- Fields as text, a number, yes or no, or a list of text
- Choose the model for each step
Workflows
A step the run can show you
Six AI actions run as workflow steps: Analyze Alert, Determine TTPs for an alert or a case, Analyze Case, Draft Case Description, and Recommend Tasks. Conditions decide what they run on, and what they suggest waits for an analyst.
The built-in After-Hours Alert Brief runs AI alert analysis on new high and critical alerts outside business hours, so the on-call analyst starts from a verdict that quotes the alert.
- Conditions decide which alerts or cases a step runs on
- The run shows what each step did
- The organization's AI data policy applies to every step
Analytics
A chart from a question, counted by the database
Ask a question about your alerts and get a chart. The model reads the question once and chooses what to count; the numbers come from your database, not from the model. Switch between bar, line, and pie, export the data as CSV, or add the chart to a dashboard.
- Charts by status, severity, source, or day
- Counts and average severity
- Suggested questions to start from
Control
Connect the model you run
CaseBender does not ship a model. In the AI settings, connect a server in your network, such as Ollama, vLLM, LM Studio, or LocalAI, or a cloud vendor such as OpenAI, Anthropic, or Google. Check which features a model supports before you make it the default.
If the chosen model is unavailable, AI features stop and say why instead of switching to another provider.
- Each organization chooses its own providers and default model
- The AI data policy can allow private models only
- Check features reports text, fields, charts, and streaming
Control
What is recorded, and what is not
The AI settings list each feature's calls, error rate, latency, and tokens. The list is built from call metadata only: prompts and answers are not stored, and the records are kept for 90 days by default.
- Calls, error rate, median and p95 latency, tokens in and out
- Prompts and answers are not stored
- Kept for 90 days by default
Questions
Before you connect a model
Does CaseBender include a model?
No. AI is optional, and CaseBender does not ship a model. Without one, every other part of CaseBender works as it does today.
Which providers can I connect?
Model servers in your network: Ollama, and OpenAI-compatible servers such as vLLM, LM Studio, and LocalAI. Cloud vendors: OpenAI, Anthropic, Google, Azure OpenAI, Groq, DeepSeek, and xAI.
Does case data leave my network?
Only if you connect a cloud vendor: the alert or case data a feature uses is then sent to that vendor. A model in your network keeps it inside. An organization's AI data policy can allow private models only.
What happens if the model is down?
AI features stop and say why. CaseBender does not switch to another provider on its own, and the rest of the product keeps working.
Can AI change a case on its own?
Its suggestions wait for an analyst. Techniques are added when you approve them, a severity when you apply it, a task when you create it, and a draft when you accept or insert it. A Prompt step's fields go only to the workflow steps you put after it, and you can read and simulate those steps before the workflow runs.
See the AI features on a live call
We run them on our demo installation and show what each one was given, and where it waits for an analyst.