On This Page

Home / Search/ Get Data In/Dataset Intelligence

Dataset Intelligence ​

Dataset Intelligence generates an AI-powered reference file for a Dataset by analyzing its contents, field structure, and event patterns. Once generated, the file is used automatically by Cribl Search investigations to improve Dataset selection and query accuracy during the data source identification phase.

Before You Begin ​

  • AI must be enabled in your organization.
  • You must have read access to the Dataset. Dataset Intelligence is only available for Datasets you can access.

Enable Dataset Intelligence ​

You can enable Dataset Intelligence from three places. All three produce the same result.

From the Dataset modal:

  1. Open the Dataset you want to analyze.
  2. Select the Dataset Intelligence tab.
  3. Select Enable Dataset Intelligence.

From the Datasets list:

  1. On the Search Home page or the Datasets page, select the actions menu (three dots) next to a Dataset.
  2. Select Enable Dataset Intelligence.

When favoriting a Dataset:

  1. Select the star icon to favorite a Dataset.
  2. In the prompt that appears, select Enable Dataset Intelligence.

After enabling, a notification confirms that Dataset Intelligence is running. Select Dataset Details in the notification to open the Dataset modal and monitor progress.

For Datasets you can edit, select Save after clicking Enable Dataset Intelligence to commit the change. The generation starts after you save.

Monitor Generation ​

After enabling, Cribl Search runs the Dataset Intelligence agent asynchronously against the Dataset. This typically takes 2-3 minutes.

The Dataset Intelligence tab shows a spinner with the message “Generating Dataset Intelligence” while the agent runs. The tab refreshes automatically every 5 seconds until generation completes or fails (up to a maximum of 5 minutes).

When complete, the tab displays the generated reference file in a read-only Markdown editor.

What the Reference File Contains ​

The generated file is a structured markdown document with the following sections:

  • Overview: A narrative description of the Dataset’s contents, data types, and any heterogeneous structure worth noting.
  • Record families: One entry per distinct log or event type, each with a ready-made KQL filter scoped to that Source and the fields found in sampled events.
  • KQL field rules: Dataset-specific field access rules, such as fields that require bracket-quoting, fields that are numeric rather than string, and nested object access patterns.
  • Semantic field mappings: How fields map to common concepts such as user, action, status, and timestamp across the different record families.

This file is used automatically by investigation agents via the get_dataset_context tool. You do not need to reference it manually.

Disable Dataset Intelligence ​

To remove the reference file from a Dataset:

  1. Open the Dataset modal.
  2. Select the Dataset Intelligence tab.
  3. Select Disable Dataset Intelligence.

For editable Datasets, select Save to apply the change. For read-only or default Datasets, the file is removed immediately.

Disabling Dataset Intelligence does not affect the Dataset itself or any investigations already in progress.