AI Preview is available in Zwall Enterprise through operator-controlled workflows. You supply API credentials for a supported OpenAI-compatible endpoint, including a local compatible server. The model helps explain selected security events and draft recommendations. It does not apply firewall rules. Packet enforcement does not depend on a model.
Zwall already collects events and applies policy without a model. AI Preview exists so an operator can ask for an explanation or a draft in the same console.
Operators already have logs, Hosting signals, and Virtualization events. AI Preview shortens the time to read eligible security events. It does not replace rule assignment, Hosting ACLs, or release admission. It is Preview, off by default, Enterprise-only.
Status: recommendation_only; enforcement_applied is not a live apply path. Saving a provider does not start analysis. /health/ready does not wait on AI.
| Action | Description |
|---|---|
| Explain | Explain a security log |
| Analyze | Analyze an incident from selected events |
| Draft | Draft a recommendation or unpublished rule review record |
| Compare | Compare analyses in the console |
You supply an OpenAI-compatible chat-completions client only, including a local compatible server. First-class xAI, Claude, Gemini, or Azure OpenAI product integrations are not current.
The browser does not hold the key and does not call the model. Custody details for Enterprise customers are delivered separately — public copy stops at "Manager-side."
Only administrator-triggered analysis of already ingested security logs is in scope. If redaction stays enabled, usernames, private IPs, and hostnames are masked by default. Manual analysis requires explicit acknowledgements (advisory-only, provider retention, cost bound, exact IP as applicable). Training export must remain disabled. Default provider-network policy does not aim at arbitrary private networks.
Approving a recommendation records review intent. It does not create, enable, or deploy a live rule. Operators apply policy through the ordinary rule path. There are no registered apply/enforce/create-rule AI routes.
Current provider-backed AI workflows do not automatically analyze Hosting Agent sources. No Hosting raw logs to the model. Operators still investigate Hosting in the console without sending those sources to a provider.
A dedicated private Zwall AI offering is in development and is not generally available. AI Preview is the current supported path.
No.
The Manager calls an OpenAI-compatible endpoint you configure. Not the browser.
You need a compatible chat-completions endpoint. A local compatible server is supported.
No.
In development; not generally available.
No.
No. Use the ordinary rule path.
Read the documentation or talk to an engineer about Zwall Enterprise.
