Schildmark Analyst

Schildmark Analyst answers questions about your environment in plain language and runs the investigation behind the answer: it queries your endpoint alerts, vulnerabilities and inventory, and the vendor data you have connected (Defender, Intune, Cloudflare, AWS, NIDS).

Requirements

• The ai module.
• An OpenAI-compatible LLM endpoint: LLM_BASE_URL, LLM_MODEL and, if it needs one, LLM_API_KEY. Hugging Face's router, vLLM, Ollama's /v1, Azure OpenAI and others work. See AI settings. An endpoint with a publicly trusted certificate, or one issued by the stack's own CA, works as is. For an endpoint behind your organisation's private CA, see Private CA.
• Schildmark Analyst application access on the user's account (Users and roles).

With the Hosted Analyst add-on (talk to sales to add it), we run the analyst for you in our environment with our LLM gateway, so you need no endpoint of your own and none of the LLM_* settings. You open it at the same address with the same sign-in. See Optional hosted services.

Private CA

Put the PEM certificate(s) of your CA in runtime/pki/extra-ca.pem (in /opt/theseus on servers installed with an install command), run ./theseus config apply, then restart the services that call the endpoint, for example ./theseus restart pallas. The file is appended to the trust bundle the analyst, reporting and the other services that call out use (runtime/pki/trust.pem). It must hold certificates only: config apply stops if it holds a key or no certificate. Remove the file and do the same again to stop trusting that CA.

Open the analyst

• Schildmark Analyst in the console's top bar opens it in a new tab, at https://<your domain>/ai/.
• Alerts → Alert triage shows its triage view inside the console.

Sign-in is the same account as the console.

What it does

View	Use it to
Ask the analyst (SOC chat)	Ask questions: "which hosts talked to this IP", "what changed on web-01 yesterday". Threads are kept
Alert triage	Work through alerts grouped into incidents, with a narrative of what happened
Daily standup	A summary of the last day
Vulnerabilities	Vulnerability questions across the fleet
Correlations, attack narratives	Related events assembled into a story
IOC detection	Check indicators against your data
Decoder lab	Help with log decoders

On an incident the analyst can acknowledge, close (with a disposition), dismiss a false positive, mute through the console, block an address at the perimeter, propose a patch, and create or assign a Jira ticket (jira module). Actions follow your role's permissions and the protected IPs.

Jira

With the jira module and the JIRA_* settings, the analyst's incidents are synchronised to a Jira project every minute, with a daily sweep at 08:00 UTC. Jira calls back to https://<your domain>/ai-analyst/api/integrations/jira/webhook with JIRA_WEBHOOK_SECRET.

When the LLM is unavailable

The analyst still returns the data it found, with:

Risk Summary: Automated analysis temporarily unavailable. Manual review of the data above is required.

and "LLM analysis service is unreachable" among the observations. See LLM unreachable.

Data

Questions and the data the analyst reads are sent to the LLM endpoint you configure. Choose an endpoint whose data handling suits you, or a model you run yourself.

With the Hosted Analyst add-on, they go to our LLM gateway and from there to an AI provider, as your AI data policy allows (Standard, BAA only or Off); see Hosted Schildmark Analyst and your data.