AI Insight
Not just a language interface: analytical functions invoked and correlated in the operational context.
Natural language questions, contextualised answers
AI Insight uses local artificial intelligence models to interpret questions about monitoring data and the Infinity modules. The native agentic engine translates the operator’s request into an operational goal, selects the platform functions, runs the processing, correlates the results and returns contextualised assessments, going beyond a simple answer.
A specialised SLM (Small Language Model), optimised to run entirely on premises, delivers immediate answers with maximum confidentiality.
The information available
The engine works on the knowledge bases managed or integrated by the platform, within the customer’s perimeter:
- Asset inventory, topologies and dependencies between ICT services
- Monitoring metrics and states
- NetFlow flows and communication relationships
- Vulnerabilities, CVEs, exposure and reachability
- Security information and activity observed on endpoints
- SIEM alerts and correlations with the systems involved
How a request is processed
From the operator’s question to an assessment that supports the decision, in five stages.
| Stage | Operation |
|---|---|
| Interpretation | The operator states the goal in natural language. |
| Selection | The engine identifies the functions and knowledge bases required. |
| Processing | The permitted calculations, analyses, filters and correlations are run. |
| Contextualisation | The results are related to assets, topology, communications and exposures. |
| Delivery | The system presents assessments and recommendations to support the operator’s decisions. |
What you can ask
From risk analysis requests to specific questions about a host or service.
Operational requests
- “Calculate the possible attack paths towards the production database and identify the nodes to protect first.”
- “Assess which vulnerabilities generate the greatest exposure, taking into account topology, reachability and actual communications.”
- “Correlate the security alerts with host information and analyse the possible consequences of a compromise.”
- “Identify the hardening measures with the highest potential for risk reduction.”
- “Who did this server communicate with last night?”
Questions about hosts and services
- “Which processes are currently running on IP 192.168.23.4?”
- “Which services have had the most problems on that IP in the last 24 hours?”
- “When did service x last work correctly?”
- “Which users changed the status of service x?”
- “Which users logged in between 18:00 and 05:00 on that IP?”
- “Has the software installed on that IP changed in the last month?”
On-premises deployment and data control
The AI architecture is designed to run on premises: the local models process infrastructure and security information within the customer’s perimeter. This is an important requirement for public administrations, critical infrastructure and organisations subject to strict data management rules.
More modules, more context. Adopting the Infinity modules broadens the information available and enriches AI Insight’s correlations: flows from Network Insight, host status from Security Insight, vulnerabilities and paths from Threat Insight.
For Security Operations Automation teams, AI Insight means assisted execution of analyses and correlations through agentic AI.
Related topics
Want to see Sentinet³ on your infrastructure?
Tell us about your environment: sites, technologies, critical services. We will show you how Core and Infinity can work on your case.