In Cribl.Cloud Government, Cribl AI runs only through a Custom AI Provider that you configure, and web search is unavailable. See AI in Cribl.Cloud Government.

Cribl AI tools and capabilities help you streamline your work and maximize your productivity with Cribl products. Use ordinary language, or natural language, to get answers to product questions, perform advanced searches, create Pipelines, and more.

Cribl AI includes the following features:

• Chatbot: Answers common questions, helps troubleshoot issues in all Cribl products, and inspects your deployment configuration to answer questions about your environment.
• Copilot Editor: Helps you create and edit data transformation Pipelines.
• Background detection: Provides periodic alerts about sensitive entities detected in your data stream. Background detection runs locally using regex rules and a specialized named-entity-recognition (NER) model. It does not call out to a large language model (LLM).
• Analyze detections: Uses an agentic Guard workflow (LLM-driven) to review background detections, identify likely false positives or true positives, and recommend the next mitigation step. All recommended actions remain user-reviewed and auditable.
• Guard recommendations: Surfaces a recommended action for each detection, such as creating a rule, marking an item mitigated, or ignoring it, so you can act on findings quickly. All recommendations remain user-reviewed.
• Cribl Search agents guidance: Enables guidance for AI agents that interact with Search. You can edit the guidance in the search/agents.md file.
• Search investigations: Allows users to run interactive, AI-assisted investigations in Cribl Search.
• KQL assistant: Translates your natural-language queries into Kusto Query Language (KQL) in Cribl Search.
• Visualization assistant: Helps you create custom Chart and Dashboard visualizations in Cribl Search.
• AWS Cloud Connections recommendations in Cribl Stream: Suggests a ranked list of AWS log sources to onboard, values for Source configuration, and a Destination from those available in the Worker Group. Cribl onboards only the recommended AWS log sources that you add, and you can review and change the suggestions for Source configuration values and Destinations before you continue.
• Web search: Allows a Cribl agent to search the web for additional context when running Search Investigations.
• MCP server: Lets external MCP clients, such as Cursor, Claude Code, or Codex, connect to your Cribl environment and work with your Sources, Destinations, Pipelines, metrics, and Search Notebooks through natural language. An admin enables the MCP server in AI Settings. After that, any user can connect, and Cribl scopes the available tools to that user’s permissions. The MCP server does not use Cribl-managed or custom AI providers; the client hosts its own model.
• MCP integrations: Connects Cribl AI agents to external MCP servers, making third-party tools available during AI-assisted workflows. Currently, only Search investigations and Copilot Chat use MCP integrations.

Cribl AI Availability ​

Cribl AI is a native part of the Cribl product suite. AI feature entry points appear across supported Cribl products. Most AI features run only when a user explicitly invokes them. Cribl Guard is the exception: its preliminary scan runs automatically, and after you enable Guard on a Destination, background detection continuously samples eligible Pipeline events without a per-use action. Cribl AI doesn’t have a product-level setting that controls its availability. Instead, you control which AI provider processes your data, and every deployment is always in one of these states:

• Cribl-managed models power AI features. This is the default for new deployments and requires no further configuration.
• Your own AI provider powers AI features. Configure a Custom AI Provider to bring your own model (BYOM), whether cloud hosted or self hosted.
• No AI provider is configured. AI feature entry points stay visible, but they aren’t operational until you configure a provider.

Cribl.Cloud Government reaches only the last two states. Cribl-managed models are never available there, and AI Settings offers no control to switch to them. See AI in Cribl.Cloud Government.

When you upgrade an existing deployment, Cribl maps the saved AI provider and consent configuration to one of these states. A deployment that previously declined AI explicitly and has no saved provider mode starts with no provider configured. Its AI feature entry points appear, but they don’t run until you configure a provider. Other deployments without a saved provider selection use Cribl-managed models by default.

The embedded MCP server is an exception to provider-based availability. Enable MCP Server near the top of AI Settings, above AI Model Providers. That control is independent of which LLM provider is selected, because MCP clients use their own models rather than Cribl AI providers.

Feature Configuration ​

Most Cribl AI assistants don’t have individual availability switches. The Feature Configuration section does include separate controls for Web Search and MCP Integrations. When an AI provider is configured, every other AI feature entry point across the Cribl products you use is available. Most features still run only when a user explicitly invokes them; Cribl Guard is the exception, as its preliminary scan and background detection run automatically. Which features are available in your deployment depends on the Cribl products you use. See Feature Availability.

In the Feature Configuration section of AI Settings, you can adjust the following:

• search/agents.md: Edit this file to provide guidance to the AI agents that interact with Cribl Search.
• MCP Integrations: Allow Cribl Search investigations and the Copilot chatbot to call approved external tools and data sources through MCP servers.
• Web Search: Allow a Cribl agent to search the web for information during Search investigations. In Cribl.Cloud Government, this control is disabled and you cannot turn it on.

To enable the embedded MCP server, use the MCP Server control near the top of AI Settings, not Feature Configuration. You can copy a Bearer token from that control, or from the Bearer Token row at Settings > Global > Information. For setup, see Work with the Cribl MCP Server.

Get Started With Cribl AI ​

The first time you open a deployment, Cribl shows a modal that AI features are available. Here, you choose the provider that powers Cribl AI.

1. On the modal, select Continue to open Settings > Global > AI Settings.
2. In the AI Model Providers section, review the selected provider. The default selection, Cribl Default, uses Cribl-managed models for all AI features and does not require further configuration.
3. To route Cribl AI through your own provider instead, select Use Custom AI Provider and complete the configuration wizard. For details, see Custom AI Providers.

After you configure the provider for your deployment, the AI feature entry points across supported products are ready to use.

Feature Availability ​

Cribl AI feature availability varies by deployment type.

Available in on-prem deployments:

• Copilot chatbot
• Copilot Editor
• Function assistance for Pipelines
• Copilot-generated commit messages
• Guard rule generation
• Guard recommendations

Available in Cribl.Cloud:

All on-prem features, plus:

• KQL assistant
• Visualization assistant
• Search investigations
• Web search
• Cribl Search agents guidance
• Notebook summaries
• AWS Cloud Connections recommendations

Available in Cribl.Cloud Government:

All Cribl.Cloud features except web search, which cannot be enabled. The Copilot chatbot also cannot search the Cribl documentation, and Cribl Guard offers one local detection model. Every feature that calls an LLM requires a Custom AI Provider. Guard background detection and the embedded MCP server do not, because neither calls an LLM. For the full list of differences, see AI in Cribl.Cloud Government.

To route supported features through your own AI provider instead of Cribl-managed models, see Custom AI Providers.

When AI Features Can’t Run ​

Cribl AI is a native part of the product, so its entry points stay visible in supported products even when a feature can’t complete a request. Because AI features rely on a reachable, correctly configured provider, a request can fail during a network interruption or when a configured custom provider can’t connect. Rather than hide the entry point or fail silently, Cribl keeps it visible and shows a message that prompts you to verify your provider configuration.

For example, suppose you configure a Custom AI Provider that Cribl cannot reach. When you open a feature that needs AI, such as Cribl Guard, Cribl displays a message that prompts you to verify your configuration. Select AI Settings on the message to review and fix your provider configuration. The affected feature becomes available again automatically when Cribl can reach the provider.

If you use a Custom AI Provider, see When Your Custom Provider Is Unavailable for provider-specific connectivity behavior.

Cribl AI and Your Data ​

Cribl AI accesses only the minimum context each feature needs, not all the event data flowing through Cribl. Depending on the feature, this can include limited user-selected or sampled events along with query, configuration, or operational metadata. Cribl does not use your data to train large language models (LLMs). For what each feature accesses, how Cribl processes it, and which features run locally instead of calling an LLM, see Cribl AI and Your Data.