Configure global AI settings

how to configure AI settings that apply to each of the agents

For each of the settings described in this article, use the Global AI settings page.

To reach the Global AI settings page, follow these steps:
  1. In Splunk Enterprise Security, select Configure and then All configurations.
  2. Select AI and then select Global AI settings.

  3. After making any updates, select Save.

Turn agentic AI offerings on or off

You can configure all agentic AI offerings so that they are turned on or turned off for your organization.
Note: Agentic AI offerings won't work if they are turned off.

To turn agentic AI offerings on or off, follow these steps:

  1. In the Global AI settings page, locate the AI availability section.

  2. Toggle the setting to turn on or turn off all AI capabilities in your environment.

Opt in or out of AI training and fine-tuning in Splunk Enterprise Security

Note: The AI features in Splunk Enterprise Security are subject to Microsoft's Azure OpenAI

Acceptable Use Policy

and Code of Conduct Content requirements.

The AI Assistant can collect telemetry and prompt feedback in Splunk Enterprise Security to help improve the product and train models. By default, Splunk does not use this AI service data for training or fine-tuning, but you can choose to opt in or opt out at any time.

Opting out gives you greater control over your data and helps support compliance with privacy regulations. When you opt out, Splunk immediately stops using new telemetry and feedback for training and fine-tuning, but does not delete any previously collected data. Opt in to allow Splunk to use your AI service data to improve the product and train models.

To opt in or opt out, follow these steps:

  1. In the Global AI settings page, locate the Use of Data for Training and Fine-Tuning section.

  2. To opt in, select the check box for Allow Splunk to use your AI Service Data. To opt in, clear the check box.

Select the models the AI Assistant uses in Splunk Enterprise Security

Note: The AI features in Splunk Enterprise Security are subject to Microsoft's Azure OpenAI

Acceptable Use Policy

and Code of Conduct Content requirements.

The AI Assistant uses data models to provide results for your prompts. Choose between Frontier or Splunk-hosted models for the AI Assistant to use based on your organization's compliance requirements.

To modify the model settings in Splunk Enterprise Security, follow these steps:

  1. In the Global AI settings page, locate the Model choice section.

  2. Select the option for your preferred model usage.

    • Let Splunk determine the best model, which can include third-party or external models

    • Limit usage to Splunk hosted models only