Skip to content

LogMan.io AI SIEM

TeskaLabs LogMan.io AI SIEM is an AI agentic platform embedded in TeskaLabs LogMan.io. It connects large language models (LLMs) to tools, skills, and a controlled sandbox so analysts and operators can investigate, author detections, query data, and automate SIEM work through natural language.

The platform has two layers:

Layer Role
Inference Runs the language model: chat completions, streaming tokens, and reasoning.
Harness Everything around the model: conversations, tools, skills, sandbox, shares, human-in-the-loop controls, and slash commands.

The harness turns a raw LLM into a reliable SIEM AI agent. The model proposes actions; the harness executes them, streams progress to the UI, enforces safety policies, keeps an audit trail, and holds durable context across sessions.

Hint

The harness is implemented in the microservice called llm-microlink. It runs on the customer premises, next to the rest of LogMan.io and the sandboxes. Inference usually runs in the TeskaLabs AI cluster and is reached over the network.

Diagram: LogMan.io AI SIEM Architecture

The diagram shows the deployment split:

  • TeskaLabs — LLM inference and routing. The harness sends prompts and receives streamed model output; customer event data does not need to live in the AI cluster.
  • On-premise customer — llm-microlink (the harness), the user session, and the Sandbox. Skills and tools execute here, so access to LogMan.io and to internal hosts stays inside the customer boundary.
  • From the sandbox the agent can call the LogMan.io REST API and, when a skill requires it, reach external hosts (for example over SSH).

Bring your own inference

You can point the harness at your own inference endpoints instead of the TeskaLabs AI cluster. That option exists for special deployments; the default and recommended path is TeskaLabs-hosted inference. See Inference.

Typical use

Most day-to-day work is a person at a computer chatting with the agent in the LogMan.io UI:

  1. The user opens a conversation (or an agent) and states a goal.
  2. The harness builds instructions from the default prompt, Soul, available skills and tools, and optional facts — all sourced from the Library where relevant.
  3. The LLM streams reasoning and may emit tool calls.
  4. The harness runs tools in the on-prem sandbox (shell, library read, ask user, REST helpers, …), optionally after vetting.
  5. Results return into the conversation; the loop continues until the task is resolved.

The same harness also supports fully autonomous runs — agents and scheduled jobs that work without an interactive chat. You can mix modes: chat for some steps, vetting for sensitive tools, and autonomy for the rest. See Human-in-the-loop and control and Conversations.

What you can do

  • Investigate — search and analyse events (lmio-query)
  • Detection engineering — draft, unit-test, and hunt correlation rules (lmio-detection-engineer)
  • Product knowledge — answer “how does X work?” from documentation and the Common Library (lmio-knowledge)
  • Operate via API — call LogMan.io REST endpoints (lmio-rest-api)
  • Infrastructure — SSH and remote admin patterns (devops)
  • Remember — Soul and durable facts (soul-bootstrap, facts)
  • Automate — goal-driven agents and schedules