Pallas AI analyst

Pallas answers questions about your environment in plain language and runs the investigation behind the answer: it queries your Wazuh alerts, vulnerabilities and inventory, and the vendor data you have connected (Defender, Intune, Cloudflare, AWS, NIDS).

Requirements

• The ai module.
• An OpenAI-compatible LLM endpoint: LLM_BASE_URL, LLM_MODEL and, if it needs one, LLM_API_KEY. Hugging Face's router, vLLM, Ollama's /v1, Azure OpenAI and others work. See AI settings. An endpoint with a publicly trusted certificate, or one issued by the stack's own CA, works as is. For an endpoint behind your organisation's private CA, see Private CA.
• Pallas AI application access on the user's account (Users and roles).

Hosted Pallas with our LLM gateway, so that you need no endpoint of your own, is

coming soon; see Deployment options.

Private CA

Put the PEM certificate(s) of your CA in runtime/pki/extra-ca.pem (in /opt/theseus on servers installed with an install command), run ./theseus config apply, then restart the services that call the endpoint, for example ./theseus restart pallas. The file is appended to the trust bundle Pallas, reporting and the other services that call out use (runtime/pki/trust.pem). It must hold certificates only: config apply stops if it holds a key or no certificate. Remove the file and do the same again to stop trusting that CA.

Open Pallas

• Pallas in the console's top bar opens it in a new tab, at https://<your domain>/ai/.
• Alerts → Alert triage shows its triage view inside the console.

Sign-in is the same account as the console.

What it does

View	Use it to
Ask Pallas (SOC chat)	Ask questions: "which hosts talked to this IP", "what changed on web-01 yesterday". Threads are kept
Alert triage	Work through alerts grouped into incidents, with a narrative of what happened
Daily standup	A summary of the last day
Vulnerabilities	Vulnerability questions across the fleet
Correlations, attack narratives	Related events assembled into a story
IOC detection	Check indicators against your data
Decoder lab	Help with log decoders

On an incident Pallas can acknowledge, close (with a disposition), dismiss a false positive, mute through the console, block an address at the perimeter, propose a patch, and create or assign a Jira ticket (jira module). Actions follow your role's permissions and the protected IPs.

Jira

With the jira module and the JIRA_* settings, Pallas incidents are synchronised to a Jira project every minute, with a daily sweep at 08:00 UTC. Jira calls back to https://<your domain>/ai-analyst/api/integrations/jira/webhook with JIRA_WEBHOOK_SECRET.

When the LLM is unavailable

Pallas still returns the data it found, with:

Risk Summary: Automated analysis temporarily unavailable. Manual review of the data above is required.

and "LLM analysis service is unreachable" among the observations. See Pallas: LLM unreachable.

Data

Questions and the data Pallas reads are sent to the LLM endpoint you configure. Choose an endpoint whose data handling suits you, or a model you run yourself.