Skip to content

AI Threat Analyst

Jump to bottom
Mohhudib edited this page May 29, 2026 · 2 revisions

AI Threat Analyst

Hybrid R-Sentry integrates an AI threat analyst that automatically classifies every HIGH, CRITICAL, and MEDIUM detection event using a large language model.

Multi-Provider Fallback Chain

The AI analyst supports three providers with automatic fallback:

1. Cerebras  (AI_API_KEY_CEREBRAS)   — fastest (~200ms), optional
      │ fails or not configured
      ▼
2. NVIDIA / Groq  (NVIDIA_API_KEY)   — primary fallback
      │ fails
      ▼
3. NVIDIA / Groq  (NVIDIA_API_KEY_ALERTS) — secondary fallback

Groq keys are auto-detected by the gsk_ prefix. NVIDIA keys start with nvapi-. Cerebras is skipped silently if AI_API_KEY_CEREBRAS is not set — the system works without it.

How It Works

  1. Agent sends a detection event to the backend
  2. Backend dispatches analyze_event_ai Celery task
  3. Task immediately publishes a PENDING state to the rsentry:ai Redis channel — the dashboard shows a spinner right away
  4. Task calls the AI provider with structured event context
  5. LLM returns a JSON classification
  6. Result is published to the rsentry:ai Redis channel as ai_analysis_update
  7. Dashboard receives the update via WebSocket and replaces the spinner with the result
  8. Result is cached in Redis for 24 hours for forensic export

Two Independent API Keys

The system uses two separate keys to prevent rate limiting from blocking both analysis types simultaneously:

Key Used For
NVIDIA_API_KEY Live event analysis (AI Analyst page)
NVIDIA_API_KEY_ALERTS On-demand alert analysis (Alerts page)

Each key has its own Redis rate limit slot. They never block each other.

Analysis Output

Every analysis returns structured JSON with these fields:

Field Description Example
threat_type Type of threat detected Ransomware, Cryptominer, Benign
technique Attack technique used File Encryption, Canary File Access
language_or_tool Tool or language involved Python, Bash, C binary
behavior_summary Plain English explanation Process rapidly modified 40 files...
risk_level Severity assessment CRITICAL, HIGH, MEDIUM, LOW
recommendation What the analyst should do Isolate host immediately
confidence Confidence in assessment HIGH, MEDIUM, LOW

Auto-Acknowledgment

When the AI classifies a threat as Benign or LOW risk, the linked alert is automatically acknowledged — no manual action needed. This reduces alert fatigue for common false positives.

System Health Check

The AI Analyst page includes a Run System Health Check button that:

  1. Fetches the last 100 events from the backend
  2. Sends them to the LLM for aggregate analysis
  3. Returns an overall system status assessment

Health check output includes:

Field Values
status STABLE, UNDER_ATTACK, ANOMALOUS, RECOVERING
behavior_summary 2-3 sentence description of overall activity
risk_level Overall risk level
recommendation What to do next

Rate Limiting

The system uses a Lua-based atomic rate limiter in Redis to enforce a minimum delay between API calls per provider. This prevents hitting the rate limit while allowing multiple Celery workers to run in parallel.

Analysis Persistence

AI analyses persist for 4 minutes after navigating away from the AI Analyst page. This is managed by lifting state to App.jsx with a 15-second expiry check interval.

Error Handling

If all providers fail (rate limit, network error, invalid key):

  • An error card is displayed on the AI Analyst page
  • The pending spinner is replaced with a visible error message
  • The alert is not auto-acknowledged
  • Celery logs the failure with the provider name and error reason

Clone this wiki locally