Pipeline
Last status
—
Outcome of the most recent train / trigger cycle
Scheduler
—
Idle, running, or actively training
Sync & model health
Watermark
—
Next eligible
—
Total documents
—
Macro F1
—
How to call the model
POST to /ai-api/v1/chat/completions with model socai-alert-classifier. Create a bearer key under API Tokens.
Training loop
Start runs continue-train cycles on a schedule. Stop cancels the loop, an in-progress train, and any retrain. Retrain replaces a running retrain, deletes the current model, and trains from scratch.
Training is stopped.
Current job
—
No active job. Status updates automatically when training starts.
idle
mode: —
updated: —
ETA: —
Read
—
Dropped
—
Kept
—
Epoch
—
Step
—
Best macro F1
—
Checkpoint
—
Job progress
0%
Validation metrics
Scores from the latest completed epoch on the hold-out set.
—
Event log
Bootstrap and train events. Refreshes while a job is running.
OpenSearch source is the cluster connection for Training data and Jobs. Ingest settings belong here. Model training parameters live under Training data → Training configuration.
Loading the active profile…
Training data is a dedicated OpenSearch index with a fixed schema. Cluster access comes from the OpenSearch source saved on the Settings tab. YAML and environment credentials are not used here.
Loading…
Index
—
Exists
—
Documents
—
Schema
—
Re-filter training data
Remove rows that are near-copies of an older row in the same category and subcategory. The oldest row of each group is kept.
Required fields
Jobs map source fields onto this schema. Extra fields are rejected.
| Field | Type | Used for |
|---|
Schedule, continue-train, optimization, data, model and tokenizer. Apply a package to fill these fields, or save the current values under a name. Next cycle settings apply on the next train. Full retrain settings apply when a new bootstrap builds a checkpoint.
Loading the active profile…
Configuration packages
Built-in presets update training parameters immediately. Save the current parameters as a named package to reuse them later.
No package applied.
A job copies documents from another index into the training data index on a schedule. Cluster access is the OpenSearch source saved on the Settings tab.
Loading…
Jobs
Each run copies source documents whose timestamp is after the previous run. The first run uses the lookback window. Stop keeps the definition. Delete removes it.
| Name | Source | Schedule | Status | Last run | Copied | CTL skipped | Actions |
|---|
No jobs yet. Create one to copy labeled documents into the training data index.
LLM review
Rows cleaned by the LLM wait here. Nothing from an LLM job reaches the training data index until you approve it. Delete drops the rows.
No LLM job selected.
| Source ID | Subject | Labels | LLM output |
|---|
Logs
Stored records with their analysis results, newest first. Select a row for details.
| Time | Severity | Category | Source | Channel | Message | Hits |
|---|
No records match these filters.
Run history
Completed trigger and continue-train cycles, newest first.
| Time | Status | New docs | Macro F1 | Watermark | Next eligible | Actions |
|---|
Rows
No records yet. Entries appear after the first trigger.
API tokens
Bearer keys for service calls. The secret is shown only once at creation.
New token (copy now)
Example request
| Name | Prefix | Created by | Created | Last used | Status | Actions |
|---|
No tokens yet. Create one to start calling the API.
Integration guide
OpenAI-compatible inference API for n8n, scripts, and service clients.
Base URL
/ai-api/v1
Auth
Authorization: Bearer sk-socai-…
Model
socai-alert-classifier
Endpoints
POST /chat/completions · GET /models
cURL — classify an alert
Python — OpenAI SDK
Response shape
choices[0].message.content → JSON string
{
"category": "…",
"subCategory": "…",
"severity": "…",
"category_confidence": 0.0,
"subCategory_confidence": 0.0,
"severity_confidence": 0.0
}
Use a token created above. Panel Keycloak sessions cannot call /v1/* — only sk-socai-… API tokens.
Alert text
The SIEM pipeline cleans the text and stores it with its metadata; the model classifies the clean text.
Analysis
Predicted labels, the stored SIEM record and all of its metadata.
Category
—
—
SubCategory
—
—
Severity
—
—
Model
—
SIEM record
Metadata
Extracted
Parsed fields
Clean text
Results will appear here.
One log travels through four stages. Each tile is a stage; the line under a number says what it counts.
Alert rules
Active rules run in the background after every analysis. Nothing is restarted.
Receive-only analyze
Clients POST to /ai-api/api/ingest
with header X-SOCAI-Client-Key.
The response is 202 Accepted only — analysis runs in the background.
Log shippers (NXLog, the syslog listener) POST NDJSON or one event per line to
/ai-api/api/ingest/bulk.
A batch is queued whole or rejected with 503.
Queue
—
Accepted
—
Rejected
—
Completed
—
Errors
—
Avg latency
—
Live traffic
Events per minute for the last 60 minutes. Updates while this tab is open.
Queue
Stop processing halts analysis; incoming logs keep queuing and survive restarts. The choice is kept across deploys. Reset clears counters and the last 10,000 operations — clients and the blacklist stay.
—
| Time | Client | IP | Status | Ref |
|---|
Rows
No ingest operations yet.
Clients
Named keys for the X-SOCAI-Client-Key header. The secret is shown only once.
New client key (copy now)
| Name | Status | Prefix | Defaults | Allowed IPs | Key | Last used | Created | Actions |
|---|
No ingest clients yet. Generate a key to accept traffic.
IP blacklist
An IP that sends too many unknown keys is banned automatically. You can also add or remove addresses here.
| IP | Reason | Hits | Added | Actions |
|---|
No blacklisted addresses.