Turn the AI Assistant on or off in Splunk Enterprise Security

Note: AI features for Splunk Enterprise Security must be turned on by an administrator on the Security AI Assistant settings page. The AI features in Splunk Enterprise Security are subject to Microsoft's Azure OpenAI

Acceptable Use Policy

and Code of Conduct Content requirements.
The AI Assistant in Splunk Enterprise Security helps you work through investigations by summarizing findings, explaining activity in clear language, and suggesting next steps. You can use it to generate SPL searches, explore related activity, and create notes or reports directly from an investigation. This can save time during triage and help you decide when to escalate. You can turn the AI Assistant on or off at any time in the configuration settings.
  1. In Splunk Enterprise Security, select Configure and then All configurations.
  2. Select Security AI Assistant settings.
  3. In the AI Assistant availability section, toggle the setting to turn on or turn off the AI Assistant.
After you turn on the AI Assistant, you can select the AI Assistant icon () on the Mission Control page to open it. For more details on what you can do with the AI Assistant, see Summarize findings and investigations with the AI Assistant.