Configure Custom AI Providers
The Custom AI Providers feature enables a Bring Your Own Model (BYOM) approach, letting you connect your own large language model (LLM) backend to Cribl AI features instead of using the default Cribl-managed LLMs. This topic describes how to add, edit, or delete a custom AI provider.
Prerequisites
Before you start, make sure that:
- You have Owner or Admin permissions for the on-prem deployment or Cribl.Cloud Workspace.
- Cribl AI is enabled for your deployment (Cribl.Cloud or on-prem).
- You have decided which Cribl AI features you want enabled or disabled in AI Settings.
- For on-prem deployments, you are configuring your LLM on the Leader Node (not on a Worker/Edge Node), and the Leader Node has network access to your LLM endpoints.
- You have at least one supported LLM account, with:
- A deployment identifier (such as the Deployment URL). Not required for Amazon Bedrock.
- Credentials (for example, an API key or bearer token) with permission to invoke the model.
Open AI Settings
- Sign in to Cribl:
- Cribl.Cloud: Open the Workspace where you want to configure Cribl AI.
- On-prem: Open the Leader.
- Select Settings (⚙).
- If available for your deployment, open the Global tab.
- Select AI Settings.
On the AI Settings page you can:
- Enable or disable Cribl AI.
- See whether a custom AI provider is configured for the deployment.
- Open the custom AI provider configuration wizard to add, edit, or delete your own LLM.
Add a Custom AI Provider
You can start the configuration from either of these entry points on the AI Settings page:
- The Try it! button in the custom AI providers banner.
- The Use Custom AI Provider button.
The New Custom AI Provider wizard guides you through three focused steps.
Step 1: Select a Provider Type
Choose the type of LLM backend you want to connect:
- AWS Bedrock – Anthropic Claude models accessed through AWS Bedrock.
- Microsoft Foundry – OpenAI models accessed through an Azure OpenAI / Microsoft Foundry deployment.
- LiteLLM – A self-hosted LiteLLM proxy that fronts one or more model backends.
- OpenAI Compatible – Any endpoint that implements the OpenAI Chat Completions API, including self-hosted models and third-party proxies.
Select a tile and then select Continue to move to the next step.
Step 2: Enter Connection Details
Provide the information Cribl needs to reach and authenticate with your provider.
| Field | Required for | Description |
|---|---|---|
| ID | All providers | A short, unique identifier for this provider (for example, bedrock-prod). |
| Description | All providers (optional) | A human-readable label shown on the provider card (for example, Anthropic Claude - us-east-1). |
| Deployment URL | Microsoft Foundry, OpenAI Compatible | The base HTTPS endpoint URL for your deployment. Do not include trailing slashes or path suffixes such as /chat/completions. |
| URL | LiteLLM | The base URL of your LiteLLM proxy. Do not include trailing slashes or path suffixes such as /chat/completions. |
| API Key | AWS Bedrock, Microsoft Foundry, OpenAI Compatible | The credential used to authenticate AI requests. Stored securely in the Cribl secret store and never shown to end users. |
| Virtual key | LiteLLM | The LITELLM_MASTER_KEY or a virtual key for your proxy. Stored securely in the Cribl secret store and never shown to end users. |
Select Continue to proceed to the model tier assignment step.
Step 3: Assign Models to Tiers and Test
Cribl routes AI requests to one of three model tiers based on the complexity of the task. In this step, assign specific model IDs to each tier for your chosen provider.
| Tier | Purpose |
|---|---|
| Small | Lightweight tasks: KQL explanation, search result analysis, ruleset selection. |
| Frontier | Multi-step agents: Git commit messages, Notebook summaries, Guard rule generation, KQL workflows. |
| Reasoning | Extended-context tasks: local Cribl Search assistance, complex KQL scenarios. Supports multiple model IDs – the first model in the list serves as the system default. While most features exclusively use this first model, Cribl Search investigations allow you to switch between any listed models via a dropdown menu. |
For AWS Bedrock and Microsoft Foundry, the wizard pre-fills suggested models from a supported model registry. You can select different models from the dropdown, but selection is restricted to the models Cribl validates for that provider.
For LiteLLM and OpenAI Compatible, there is no dropdown restriction. Enter the exact model IDs your endpoint accepts for each tier. Your endpoint must be able to handle every model ID you specify.
When all tiers are assigned, select Test and Save:
- Cribl tests each assigned model by sending a request through your configured endpoint.
- The results panel shows how many models passed and failed (for example, 2 passed, 1 failed).
- If any test fails, select Retry after correcting the configuration. The modal remains open so you can adjust values without starting over.
- When all models pass, the configuration is saved automatically.
After you save:
- The configuration is stored in the Cribl secret store.
- A Custom AI provider card appears at the top of AI Settings showing the provider name, type, and the number of configured models.
- Supported AI capabilities in that deployment begin using your custom provider for new requests.
Edit an Existing Custom AI Provider
You can update a configured provider if any details change (for example, keys rotate or you want to switch models).
- Open Settings > AI Settings.
- Locate the Custom AI provider card at the top of the page.
- Select the gear (⚙️) on the card, then select Edit.
- In the wizard, navigate through the steps to update the relevant fields.
- On the final step, select Test and Save to validate and apply the changes.
New AI requests use the updated configuration immediately after saving.
Delete a Custom AI Provider
Deleting a custom AI provider switches the deployment back to Cribl-managed LLMs for all supported capabilities.
- Open Settings > AI Settings.
- Locate the Custom AI provider card at the top of the page.
- Select the gear (⚙️) on the card, then select Delete.
- Confirm the deletion in the dialog.
After confirmation, the provider card is removed and Cribl AI begins using the default Cribl-managed models again.
If you want to use your own LLM again later, repeat the Add a Custom AI Provider steps.
Troubleshoot Common Errors
If there is a problem with your custom AI provider, you may see:
- Model test failures in the Test and Save step.
- Provider-specific errors surfaced in Cribl AI features.
Typical issues include:
- Invalid or expired credentials - Rotate or correct the API key, then retry.
- Wrong Deployment URL - Ensure the endpoint is reachable and correctly formatted (no trailing path suffixes).
- Incorrect model ID - Confirm each model ID exactly matches what your provider or proxy expects.
- Rate limits or quotas exceeded - Check usage and raise limits or use a different deployment.
If you cannot resolve the issue quickly, delete the custom provider to fall back to Cribl-managed LLMs while you investigate.