Cribl AI does not access all event data flowing through Cribl. Depending on the feature, it might access limited user-selected or sampled events, along with query, configuration, or operational metadata, to perform the requested or enabled workflow. Each feature accesses only the minimum context it needs when you (or an enabled automated feature) invoke it.

What Data Cribl AI Accesses ​

The following features access limited context when you invoke them:

• Cribl AI generates follow-up query suggestions by looking at your current KQL query, up to the last 50 query strings from your search history (but not their results), and sample events from the current search job, which Cribl might truncate for size limits.
• The KQL assistant helps create or refine queries by looking at the query currently in the search editor, metadata from up to 50 recently used Datasets (ID and description), and, when needed, sampled events from up to 3 Datasets with up to 5 events from each.
• The visualization assistant looks at the selected Dataset’s metadata, along with up to 5 sample events and inferred field information, to suggest effective ways to display the data.
• Copilot Editor uses user-provided or captured sample events, subject to token limits, together with the Pipeline configuration and schema context loaded into the session, to help with transformation logic.
• The Copilot chatbot can inspect your deployment configuration and live operational status when you ask, including Worker Groups, Sources, Destinations, Routes, Pipelines, Search and Lake metadata, health, and I/O metrics. Information that these read-only inspection tools return might be sent to your configured AI provider to generate a response. Some tools summarize responses or omit selected fields, and Global Variable values are excluded from chatbot inspection responses. Administrators can configure named sensitive fields to mask in Source and Destination API responses. Apply this configuration to each relevant Worker Group, and review it when configurations or integrations change. For details, see Ask About Your Cribl Deployment.
• Search investigations can run bounded searches, analyze results, and use Dataset Intelligence and Notebook context to help with an investigation. Optional web search is routed through Cribl’s AI service.
• When you configure MCP integrations, Search investigations and Copilot Chat can call tools on the external MCP servers you enable. Cribl sends the tool arguments the model generates to the external server, and the returned results can become context for the active AI model.
• Dataset Intelligence, which Search investigations uses, samples events and runs limited exploratory queries to build a Dataset reference card.
• Cribl Guard features might analyze user-selected or sampled events to recommend detection and masking rules. Background detection samples a subset of Pipeline events for on-Worker sensitive-entity detection using a downloaded model bundle.
• Other assistants, such as Notebook summary, git commit messages, and explain KQL or Pipeline, send the relevant query, Notebook section, or configuration diff for the specific action you invoke them on.

Session Persistence and Retention ​

Cribl saves Search investigation and Copilot Editor sessions automatically as you work, including the conversation messages and the feature context for each session. Cribl retains a session for at least 30 days from its last activity, then deletes it. Sessions that you continue to use stay available past 30 days, because each update resets the retention period.

Model Training ​

Cribl does not use your data to train large language models (LLMs).

Local Detection Versus LLM Processing ​

Background detection runs locally on the Worker Node using regex rules and a specialized named-entity-recognition (NER) model, not an LLM, so it does not send sampled events to an external chat-completion service. Only the separate Analyze detections workflow uses an LLM, to classify findings and suggest mitigations after detection. For the available detection models and how to select one, see Background Detection.