Cribl AI is not available in Cribl.Cloud Government.

Cribl AI tools and capabilities help you streamline your work and maximize your productivity with Cribl products. Use ordinary language, or natural language, to get answers to product questions, perform advanced searches, create Pipelines, and more.

Cribl AI includes the following features:

• Chatbot: Answers common questions, helps troubleshoot issues in all Cribl products, and inspects your deployment configuration to answer questions about your environment.
• Copilot Editor: Helps you create and edit data transformation Pipelines.
• Background detection: Provides periodic alerts about sensitive entities detected in your data stream. Background detection runs locally using regex rules and a specialized named-entity-recognition (NER) model. It does not call out to a large language model (LLM).
• Analyze detections: Uses an agentic Guard workflow (LLM-driven) to review background detections, identify likely false positives or true positives, and recommend the next mitigation step. All recommended actions remain user-reviewed and auditable.
• Guard recommendations: Surfaces a recommended action for each detection, such as creating a rule, marking an item mitigated, or ignoring it, so you can act on findings quickly. All recommendations remain user-reviewed.
• Cribl Search agents guidance: Enables guidance for AI agents that interact with Search. You can edit the guidance in the search/agents.md file.
• Search investigations: Allows users to run interactive, AI-assisted investigations in Cribl Search.
• KQL assistant: Translates your natural-language queries into Kusto Query Language (KQL) in Cribl Search.
• Visualization assistant: Helps you create custom Chart and Dashboard visualizations in Cribl Search.
• Web search: Allows a Cribl agent to search the web for additional context when running Search Investigations.
• MCP server: Lets external MCP clients, such as Cursor, Claude Code, or Codex, connect to your Cribl environment and work with your Sources, Destinations, Pipelines, and Search Notebooks through natural language. An admin enables the MCP server in AI Settings.
• MCP integrations: Connects Cribl AI agents to external MCP servers, making third-party tools available during AI-assisted workflows. Currently, only Search investigations and Copilot Chat use MCP integrations.

Cribl AI Availability ​

Cribl AI is a native part of the Cribl product suite. AI feature entry points appear across supported Cribl products. Most AI features run only when a user explicitly invokes them. Cribl Guard is the exception: its preliminary scan runs automatically, and after you enable Guard on a Destination, background detection continuously samples eligible Pipeline events without a per-use action. Cribl AI doesn’t have a product-level setting that controls its availability. Instead, you control which AI provider processes your data, and every deployment is always in one of these states:

• Cribl-managed models power AI features. This is the default for new deployments and requires no further configuration.
• Your own AI provider powers AI features. Configure a Custom AI Provider to bring your own model (BYOM), whether cloud hosted or self hosted.
• No AI provider is configured. AI feature entry points stay visible, but they aren’t operational until you configure a provider.

When you upgrade an existing deployment, Cribl maps the saved AI provider and consent configuration to one of these states. A deployment that previously declined AI explicitly and has no saved provider mode starts with no provider configured. Its AI feature entry points appear, but they don’t run until you configure a provider. Other deployments without a saved provider selection use Cribl-managed models by default.

Feature Configuration ​

Most Cribl AI assistants don’t have individual availability switches. The Feature Configuration section does include separate controls for Web Search, MCP Integrations, and the MCP Server. When an AI provider is configured, every other AI feature entry point across the Cribl products you use is available. Most features still run only when a user explicitly invokes them; Cribl Guard is the exception, as its preliminary scan and background detection run automatically. Which features are available in your deployment depends on the Cribl products you use. See Feature Availability.

In the Feature Configuration section of AI Settings, you can adjust the following:

• MCP Server: Connect AI clients to Cribl tools using a bearer token. Enable the server, then select Copy bearer token. For setup, see Work with the Cribl MCP Server.
• search/agents.md: Edit this file to provide guidance to the AI agents that interact with Cribl Search.
• MCP Integrations: Allow Cribl Search investigations and Copilot Chat to call tools from an approved list of external agents through MCP.
• Web Search: Allow a Cribl agent to search the web for information during Search investigations.

Get Started With Cribl AI ​

The first time you open a deployment, Cribl shows a modal that AI features are available. Here, you choose the provider that powers Cribl AI.

1. On the modal, select Continue to open Settings > Global > AI Settings.
2. In the AI Model Providers section, review the selected provider. The default selection, Cribl default, uses Cribl-managed models for all AI features and does not require further configuration.
3. To route Cribl AI through your own provider instead, select Use Custom AI Provider and complete the configuration wizard. For details, see Custom AI Providers.

After you configure the provider for your deployment, the AI feature entry points across supported products are ready to use.

Feature Availability ​

Cribl AI feature availability varies by deployment type.

Available in on-prem deployments:

• Copilot chatbot
• Copilot Editor
• Function assistance for Pipelines
• Copilot-generated commit messages
• Guard rule generation
• Guard recommendations

Available in Cribl.Cloud:

All on-prem features, plus:

• KQL assistant
• Visualization assistant
• Search investigations
• Web search
• Cribl Search agents guidance
• Notebook summaries

To route supported features through your own AI provider instead of Cribl-managed models, see Custom AI Providers.

When AI Features Can’t Run ​

Cribl AI is a native part of the product, so its entry points stay visible in supported products even when a feature can’t complete a request. Because AI features rely on a reachable, correctly configured provider, a request can fail during a network interruption or when a configured custom provider can’t connect. Rather than hide the entry point or fail silently, Cribl keeps it visible and shows a message that prompts you to verify your provider configuration.

For example, suppose you configure a Custom AI Provider that Cribl cannot reach. When you open a feature that needs AI, such as Cribl Guard, Cribl displays a message that prompts you to verify your configuration. Select AI Settings on the message to review and fix your provider configuration. The affected feature becomes available again automatically when the AI service is reachable.

If you use a Custom AI Provider, see When Your Custom Provider Is Unavailable for provider-specific connectivity behavior.

Cribl AI and Your Data ​

Cribl AI accesses only the minimum context each feature needs, not all the event data flowing through Cribl. Depending on the feature, this can include limited user-selected or sampled events along with query, configuration, or operational metadata. Cribl does not use your data to train large language models (LLMs). For what each feature accesses, how Cribl processes it, and which features run locally instead of calling an LLM, see Cribl AI and Your Data.