Artificial Intelligence

Several features of the Netzilo dashboard run on a large language model: the AI Assistant, AI Smart Search over your activity, guardrail generation, and the AI judge that detection rules can call. None of them runs on a model Netzilo chooses for you. You connect your own provider, and you decide which of its models each feature may use.

You manage these providers under Integrations > Artificial Intelligence.

How it works

A provider is one endpoint that speaks a protocol Netzilo supports. That can be a vendor's own API, a hosted gateway, or a server you run yourself. There is no fixed list of supported vendors.

Every model is approved per feature. There are three features:

A feature with no approved model is unavailable, and the dashboard says so where you would use it. Netzilo never falls back to a shared or built-in model.

Add a provider

1. Go to Integrations > Artificial Intelligence.
2. Click Add Provider. The dialog Connect Netzilo with an AI provider opens.

Step 1: Choose a provider

Pick the vendor you use, or one of the Custom entries if your endpoint is not listed. A preset only fills in the protocol and the address; you can change both afterwards. The Get an API key button opens the vendor's key page.

Step 2: Name and endpoint

Step 3: API Key

Paste the key for the endpoint. Netzilo never shows a stored key again: when you reopen the provider, the field reads Stored — leave empty to keep it, and leaving it empty keeps the stored key. Endpoints that need no key, such as a local Ollama or vLLM, can stay blank.

Step 4: Test the connection

Test this provider asks the endpoint which models it serves and makes the smallest request it accepts, to prove the key works. Nothing is saved, so you can test a draft. On success the dialog shows which model answered and how long it took. On failure it says what to fix:

Step 5: Models and what they may do

Testing fills in the models the endpoint reported. You can also type a model ID in Add a model id by hand and click Add. For Azure OpenAI the model ID is your deployment name.

Nothing is approved until you tick it. A freshly fetched catalogue starts with every box clear. Tick a box to let a model serve a feature, or use the checkbox in a column header to approve or clear every model for that feature. The star marks the Default: the model that answers when nobody picks one. Each feature has one default.

A model left unchecked everywhere is stored but never used. That is how you keep an expensive model available for one feature without offering it to the others.

If you list no models at all, the provider serves whichever model its endpoint reports as current. A provider then works as soon as its key is saved.

Step 6: Availability

Click Save.

Connect a System One provider

A System One (TypeSafe) provider is called directly by detection rules, not by the dashboard's features. Choose TypeSafe (System One), or Custom — System One-compatible for your own endpoint, and fill in the endpoint and key as above. The models step reads AIDR rules call this provider directly. It is not approved for any other feature, so there is nothing to approve here. On the tab, its card reads Called by AIDR rules.

How rules call it is in Detection Rules.

Edit, disable or remove a provider

• Edit: click the settings button on the card. Every field you leave alone keeps its stored value; only what you change is replaced.
• Disable: turn off the switch on the card. The dialog names the features that stop working unless another provider is approved for them. The configuration is kept, and the switch turns it back on.
• Remove: open the settings and click Remove at the bottom. The provider and its stored key are deleted. This cannot be undone.

Use more than one provider

Several providers can serve the same feature. Netzilo uses the model starred as the default. If none is starred, the provider with the lowest Priority wins, and providers with the same priority are ordered by name.

A common setup is a vendor API for the Assistant and a self-hosted endpoint for Log Analysis, so that bulk analysis never leaves your own infrastructure.

Choose the model in the AI Assistant

The AI Assistant shows a model picker next to the send button. It lists only the models approved for Assistant.

The choice stays with that conversation. If only one model is approved, the picker shows its name without a choice. Netzilo checks the choice on every message: a model you picked that has since lost its approval is refused with a message naming it, rather than quietly replaced. A conversation that only remembers a model that no longer exists falls back to the default model.

Health and the activity log

Each card shows the protocol, the features it is used for, and when the provider was last tested:

• Verified: a test succeeded at that time.
• Failed: the last test did not succeed. Hover for the reason.
• Not verified: nobody has tested it yet. It is still used; this is not a failure.

Changing the endpoint, the protocol or the key clears a previous Verified result.

Adding, changing, removing and testing a provider are recorded in Activity > Events as AI provider created, AI provider updated, AI provider deleted and AI provider verified. API keys never appear in an event, in the API or in a log.

Manage providers through the API

The public API offers the same resource. Reading needs an administrator token; creating, changing and deleting need an Owner token.

# The protocols, features and presets this server supports
curl -H "Authorization: Token $NZ_TOKEN" https://<api-host>/api/ai/protocols

# Which features this account can serve
curl -H "Authorization: Token $NZ_TOKEN" https://<api-host>/api/ai/capabilities

# The models approved for the Assistant
curl -H "Authorization: Token $NZ_TOKEN" "https://<api-host>/api/ai/models?use=assistant"

# Add a self-hosted provider
curl -X POST -H "Authorization: Token $NZ_TOKEN" -H 'Content-Type: application/json' \
  https://<api-host>/api/ai/providers -d '{
    "name": "vLLM on-prem",
    "protocol": "openai-completions",
    "base_url": "http://vllm.internal:8000/v1",
    "enabled": true,
    "uses": ["log-analysis"],
    "models": [{"id": "llama-3.3-70b", "default_for": ["log-analysis"]}]
  }'

• POST /api/ai/providers/verify tests a draft and stores nothing.
• POST /api/ai/providers/<id>/verify tests a stored provider and records the result.
• PUT /api/ai/providers/<id> keeps every field you leave out; an empty api_key keeps the stored key.
• A model without uses inherits the provider's features; a model with an empty uses list is approved for nothing.
• GET /api/ai/providers reports credential_set instead of the key.

Upgrading from the previous OpenAI and Anthropic integrations

Earlier versions configured AI as two fixed integration cards. The server converts them when it starts:

• Each configured integration becomes a provider named Anthropic, OpenAI or Custom LLM.
• It is approved for all three features, as a configured key was before.
• It lists no models, so it keeps using the newest model its endpoint offers.
• It is marked Not verified until you test it.

Nothing needs to be entered again. Review the approvals afterwards if you want a narrower setup.

Troubleshooting

The AI Assistant button is missing from the header. No model is approved for Assistant. Approve one on a provider.

AI Smart Search is greyed out on Activity > Events. No model is approved for Log Analysis.

The AI Assistant panel is missing from Add Guardrail. No model is approved for Assistant.

"The model … cannot serve Assistant" in a conversation. The model's approval was withdrawn while the conversation was open. Approve it again, or pick another model in the conversation's picker.

A self-hosted endpoint is unreachable although it works from your computer. The Netzilo Server connects to it, not your browser. Use an address the server can reach.

Related Documentation

• Providers - The models employees reach through the AI Gateway
• Guardrails - Writing guardrails with the AI Assistant
• Detection Rules - Rules that call the AI judge or System One
• Events - AI Smart Search and the activity log
• Permissions - Give regular users the AI Assistant
• AI Assistant - The AI Assistant on your own server