AI analysis

The AI page connects a large language model of your choice to the panel. You use your own API key, and the provider bills you directly. AI analysis is off until you add a model and turn it on.

What it does:

• Daily and weekly reports, written by several AI analysts and emailed to the alert recipients;
• vulnerability assessment: only the vulnerabilities that really matter on your servers are emailed right away;
• the likely cause and what to check first, in outage emails;
• IPs to block, suggested for you to confirm;
• an assistant in the bottom-right corner that answers questions about your servers;
• on-call: investigating and handling problems by itself, and tasks you give it, described in AI on-call.

Before anything is sent to the model, server names, IPs, domains and user names are replaced by codes. See Privacy.

Set it upCopy Anchor Link

ProvidersCopy Anchor Link

You can add several models. Reasoning models (for example deepseek-reasoner) think before they answer: they are slower and use more tokens, but they are better at hard analysis.

The analystsCopy Anchor Link

The work is split between several analysts. Each one can use its own model, for example a cheaper model for routine reports and a stronger one for security: AI → Settings → Analysts and models. An analyst without a model of its own uses the Default model (by default, the first model in the list).

ReportsCopy Anchor Link

AI → Reports lists every report with its level (Needs action now, Needs attention, Minor issues or All good) and its headline. A report contains:

• the summary, and the Recommended actions, marked Do first, Soon or When convenient;
• Details by analyst: what the operations, security, traffic and capacity analysts found;
• the suggested blocklist rules, if the traffic analyst found any.

To get a report now, click Report on the last 24 hours or Last 7 days. It usually takes one or two minutes.

With report emails on, the daily vulnerability digest becomes part of the daily report instead of a separate email. If the report fails, the digest is sent as usual.

Reports are kept for 180 days, and the 30 most recent ones are always kept.

Vulnerability assessmentCopy Anchor Link

With Assess vulnerabilities on, the security analyst looks at every high, critical or exploited vulnerability against what actually runs on the server: is the software running, can it be reached from the internet, is it exploited in the wild?

The verdict is shown on the vulnerability card, under AI assessment, with the reason and what to do (Suggested). Vulnerabilities exploited in the wild are always at least important.

The email about urgent vulnerabilities is one of the emails the AI decides to send, and counts toward its daily limit. With on-call on, the on-call engineer first checks whether the software is running and can be fixed, and only then decides whether to email. If the AI fails or isn't available, the usual rules apply, so nothing is missed; those emails don't count toward the limit.

Likely causes in alert emailsCopy Anchor Link

With Explain outages in alert emails on, a new outage makes the combined alert email wait for up to about two minutes while the alert analyst looks at the servers and monitors involved. The email then includes the likely cause and what to check first. If the AI takes too long or fails, the email is sent without it.

Suggested blocksCopy Anchor Link

With Suggest IPs to block on, the traffic analyst lists IPs and ranges it would block, with the reason and a duration, under Suggested blocklist rules in the report. Nothing is blocked automatically: click Block for each one, or Block all. Your own servers, private networks, Cloudflare and administrators are never suggested.

The on-call engineer can block a single IP by itself, under strict rules.

Emails from the AICopy Anchor Link

Some emails are the AI's own decision: the results of on-call investigations, and urgent vulnerabilities. AI → Settings → AI emails → Emails per day limits how many it may send per day: 5 by default, 0 = none.

• The AI always knows how many emails are left, and only emails what needs you: a problem it couldn't fix, a repair waiting for your approval or a command you must run yourself, a security incident.
• It doesn't email problems that recovered by themselves, false alarms, routine results, or things nobody can act on yet, for example a vulnerability without a fixed version or a workaround.
• When the limit is reached, the results stay in the panel.
• Not counted: the system's own alerts (servers offline, services, monitors, certificates, disks, traffic quotas), which are always sent, and the AI reports, which have their own switch. Tasks you give the AI are never emailed: you see the result in the panel.

Under the setting, the panel lists what was sent today ("Sent today: 2 of 5"). Each investigation shows on its timeline whether it emailed, for example "E-mailed the administrator (AI e-mail 2 of 5 today)", "No e-mail: the AI judged that the administrator does not need to be told now" or "Not e-mailed: today's 5 AI e-mails are used up".

The assistantCopy Anchor Link

When AI analysis is on, signed-in users see a button in the bottom-right corner of every page. It opens the AI assistant: ask about your servers, websites, vulnerabilities and traffic, for example:

• "Which server was the least stable this week, and why?"
• "Are there vulnerabilities I must fix today?"
• "Was any site attacked in the last 24 hours? Which IPs should I block?"
• "Which disk will fill up first?"

The assistant looks up what it needs (current status, server and monitor history, incidents, vulnerabilities, traffic, IP details, the blocklist, the capacity forecast) and can only read data. New conversation starts over; the conversation is kept while the browser tab stays open. The assistant never appears in display mode or on share links.

Privacy: codes instead of namesCopy Anchor Link

Before anything is sent to a model, these are replaced by codes such as SRV-7K3QF2: server names, host names, every IP address (servers and visitors), domains, monitor names, group names, user names and email addresses.

• The codes are computed with HMAC-SHA256 from a key that is stored only on the master. The model never sees the real values, and can't work them out or try common IPs or domains.
• A server's name, host name and IPs share one code, and it never changes, so the model knows which data belongs together.
• The master translates the codes in the answers back to the real names, and does the same when the model asks to look something up.

What is sent is the monitoring data the analysis needs, to the provider you configured, and nothing else. The API keys stay on the master.

Usage and costCopy Anchor Link

• Daily token limit (AI → Settings): input and output of all models together; 2,000,000 by default, 0 = no limit. When it is reached, no more calls are made that day. The field shows what was used today.
• The models list shows the calls, tokens and failures of each model over the last 30 days. The header of the AI page shows the tokens used today.
• AI report emails count toward the hourly email limit.

SettingsCopy Anchor Link

All of them are in AI → Settings and take effect as soon as you change them.

To turn everything off, switch AI analysis off.