Cribl AI is not available in Cribl.Cloud Government.

Cribl AI tools and capabilities help you streamline your work and maximize your productivity with Cribl products. Use ordinary language, or natural language, to get answers to product questions, perform advanced searches, create Pipelines, and more.

Cribl AI includes the following features:

• Chatbot: Answers common questions, helps troubleshoot issues in all Cribl products, and inspects your deployment configuration to answer questions about your environment.
• Copilot Editor: Helps you create and edit data transformation Pipelines.
• Background detection: Provides periodic alerts about sensitive entities detected in your data stream. Background detection runs locally using regex rules and a specialized named-entity-recognition (NER) model. It does not call out to a large language model (LLM).
• Analyze detections: Uses an agentic Guard workflow (LLM-driven) to review background detections, identify likely false positives or true positives, and recommend the next mitigation step. All recommended actions remain user-reviewed and auditable.
• Guard recommendations: Surfaces a recommended action for each detection, such as creating a rule, marking an item mitigated, or ignoring it, so you can act on findings quickly. All recommendations remain user-reviewed.
• Cribl Search agents guidance: Enables guidance for AI agents that interact with Search. You can edit the guidance in the search/agents.md file.
• Search investigations: Allows users to run interactive, AI-assisted investigations in Cribl Search.
• KQL assistant: Translates your natural-language queries into Kusto Query Language (KQL) in Cribl Search.
• Visualization assistant: Helps you create custom Chart and Dashboard visualizations in Cribl Search.
• Web search: Allows a Cribl agent to search the web for additional context when running Search Investigations.
• MCP server: Lets external MCP clients, such as Cursor, Claude Code, or Codex, connect to your Cribl environment and work with your Sources, Destinations, Pipelines, and Search Notebooks through natural language. An admin enables the MCP server in AI Settings.
• MCP integrations: Connects Cribl AI agents to external MCP servers, making third-party tools available during AI-assisted workflows. Currently, only Search investigations uses MCP integrations.

Cribl AI Availability ​

Cribl AI is a native part of the Cribl product suite and is available by default. AI feature entry points appear across supported Cribl products, and each feature runs only when a user explicitly invokes it. There is no product-level switch to enable or disable Cribl AI. Instead, you control which AI provider processes your data.

By default, Cribl AI uses Cribl-managed models. To route supported capabilities through your own provider instead, configure a Custom AI Provider.

Feature Configuration ​

You don’t enable or disable individual Cribl AI features. When an AI provider is configured, every AI feature entry point across the Cribl products you use is available. Each feature still runs only when a user explicitly invokes it. Which features are available in your deployment depends on the Cribl products you use. See Feature Availability.

In the Feature Configuration section of AI Settings, you can adjust the following:

• MCP Server: Connect AI clients to Cribl tools using a bearer token. Enable the server, then select Copy bearer token. For setup, see Work with the Cribl MCP Server.
• search/agents.md: Edit this file to provide guidance to the AI agents that interact with Cribl Search.
• MCP Integrations: Allow Cribl Search investigations to call tools from an approved list of external agents through MCP.
• Web Search: Allow a Cribl agent to search the web for information during Search investigations.

Get Started With Cribl AI ​

The first time you open a deployment, Cribl shows a modal that AI features are available. Here, you choose the provider that powers Cribl AI.

1. On the modal, select Continue to open Settings > Global > AI Settings.
2. In the AI Model Providers section, review the selected provider. The default selection, Cribl default, uses Cribl-managed models for all AI features and does not require further configuration.
3. To route Cribl AI through your own provider instead, select Use Custom AI Provider and complete the configuration wizard. For details, see Custom AI Providers.

After you configure the provider for your deployment, the AI feature entry points across supported products are ready to use.

Feature Availability ​

Cribl AI feature availability varies by deployment type.

Available in on-prem deployments:

• Copilot chatbot
• Copilot Editor
• Function assistance for Pipelines
• Copilot-generated commit messages
• Guard rule generation
• Guard recommendations

Available in Cribl.Cloud:

All on-prem features, plus:

• KQL assistant
• Visualization assistant
• Search investigations
• Web search
• Cribl Search agents guidance
• Notebook summaries

To route supported features through your own AI provider instead of Cribl-managed models, see Custom AI Providers.

When AI Features Can’t Run ​

Cribl AI is a native part of the product, so its entry points stay visible in supported products even when a feature can’t complete a request. Because AI features rely on a reachable, correctly configured provider, a request can fail during a network interruption or when a configured custom provider can’t connect. Rather than hide the entry point or fail silently, Cribl keeps it visible and shows a message that prompts you to verify your provider configuration.

For example, suppose you configure a Custom AI Provider that Cribl cannot reach. When you open a feature that needs AI, such as Cribl Guard, Cribl displays a message that prompts you to verify your configuration. Select AI Settings on the message to review and fix your provider configuration. The affected feature becomes available again automatically when the AI service is reachable.

If you use a Custom AI Provider, see When Your Custom Provider Is Unavailable for provider-specific connectivity behavior.

Frequently Asked Questions ​

Does Cribl AI have access to my Organization’s data?

Cribl AI does not have access to event data flowing through Cribl. The following features access limited query, configuration, or operational metadata to do their work:

• Cribl AI generates follow-up queries by looking at the last 50 queries (not their results), the current query, and field names from the last-used Dataset.
• The KQL assistant creates KQL queries from natural language by looking at any KQL query present in the search box, and at field names from the 10 last-used Datasets.
• The visualization assistant looks at your current Dataset to suggest ways to effectively display its data.
• Copilot Editor requires a single, user-selected sample event to assist in transformation logic.
• The Copilot chatbot can inspect your deployment configuration and live status, including Worker Groups, Sources, Destinations, Routes, Pipelines, system health, and similar metadata, when you ask about your environment. Sensitive values such as tokens, secrets, passwords, private keys, credentials, access keys, and Global Variable values are redacted before being sent to the AI model. For details, see Ask About Your Cribl Deployment.

Does Cribl use my data to train large language models (LLMs)?

No, Cribl does not use user data to train LLMs.

Does background detection use an LLM?

No. Background detection runs locally and uses regex rules in the Sensitive Data Scanner, plus a specialized named-entity-recognition (NER) model, not an LLM. It does not send sampled events to an external chat-completion service. The detection model you select from the Detection model drop-down at the top of the Guard page (for example, cribl-privacy-2.0 or cribl-privacy-2.0-fast) refers to one of these local NER detection bundles, not an LLM.

LLMs are only used by the separate Analyze detections workflow, which runs after initial detection to help classify findings and suggest mitigations.

How do I control which AI processes my data?

Cribl AI is a native part of the product. There is no product-level switch or Settings toggle to disable it in the Cribl.Cloud or on-prem products. AI feature entry points stay visible in your workflows and run only when you explicitly use them. Instead of enabling or disabling AI, you control which provider processes your data.

You always choose the provider that powers Cribl AI features. Use a Cribl-supplied provider or bring your own model (BYOM), including cloud-hosted or self-hosted models.

In deployments where Cribl-supplied models aren’t available, you must configure a Custom AI Provider before AI features can run. Until you configure a provider, AI feature entry points prompt you to set one up rather than disappear.