AI Assistant overview
Note: AI Assistant in Splunk Enterprise Security is available if you are on Splunk Cloud Platform or use Splunk Cloud Connect to connect on-premise deployments of Splunk Enterprise Security with Cloud-native, Splunk managed, or Splunk Cloud Services (SCS). Splunk Cloud Connect is supported for both private cloud and on-premises deployments.
The AI Assistant in Splunk Enterprise Security helps you work through investigations by summarizing findings, explaining activity in clear language, and suggesting next steps. You can use it to generate SPL searches, explore related activity, and create notes or reports directly from an investigation. This can save time during triage and help you decide when to escalate. You can turn the AI Assistant on or off at any time in the configuration settings.