AI models
Where Foxborne uses AI models, where they run and what checks each proposal before anything changes. None of them writes evidence or a finding.
Foxborne uses AI models in six places. Each is a job that a fixed rule or a hand-written parser cannot do well: reading a log format nobody wrote a parser for, finding the events that mark one moment on two clocks, checking what an engineer wrote against the records, turning an investigation into a rule, explaining a raw record, and searching by meaning.
The models never write evidence, a finding or an evidence level, and they make no before or after claim. Order still comes from the clock bounds, and conclusions still come from the engineer. A model proposes, deterministic code checks the proposal, and a person accepts it or not.
Where they are used#
| Feature | What the model does | What checks it | Who accepts it |
|---|---|---|---|
| Parsers for new log formats | Reads the first lines of an unfamiliar text log and proposes the time column, its clock, and which columns say what happened and which are measurements | The parser runs over every line before anyone saves it: records read, times that go backwards, empty measurements | An admin saves the parser |
| Matching events to align a clock | Finds events on an unaligned clock that have a counterpart on an aligned one | The delay between the two is learned from aligned runs. The offset and its bound are arithmetic, and a pair seen on too few aligned runs cannot be used | The investigator applies the alignment |
| Checking a finding against the records | Lists what the finding claims: times, time differences, values, parameters and words that state a cause | Each claim is matched to the records: a time to an event, a difference to two records and their combined clock bound, a parameter to the run's parameter set | Nobody. It marks the text and never changes it |
| Rules suggested from investigations | Reads the findings of incidents for two rules that fire in order on one vehicle | The time between the two on the incident is measured, and the runs where both fired in 90 days are counted | An admin creates the rule |
| Reading a raw record | Explains the fields of a flight log message, journal entry, receive record or process sample, and says what the record does not show | Values are converted by code, such as KiB to MiB. The record stays on screen above the reading | Nobody. It is a reading aid |
| Search by meaning | Finds evidence that says the same thing in other words, such as USB disconnects and telemetry gaps for "radio" | Every result is an event with its ID, and opening it opens the record | Nobody |
Where they run#
The models run on an inference node inside your deployment, next to the workers. In the example deployment that is one g4dn.2xlarge node with one GPU in AWS GovCloud (US-West). Hosting shows it inside the data boundary as Inference node, and lists it under Nodes as Inference (AI models).
- Nothing goes to a model provider. Outbound connections lists AI model providers as None: "Nothing. The models run on the inference node in your account. No record, prompt or result leaves it."
- The models ship in the signed release bundle, like the parsers, and air-gapped installs receive them the same way. Settings shows Foxborne models 1.0, in the signed 1.4.2 bundle with the SHA-256 of the weights. See Upgrades.
- They read only what the person using them can open. Export-controlled evidence stays behind the US person check, as Export control describes.
- Nothing is used to train a model.
Foxborne works without them. A deployment with no inference node, or with the models turned off, hides the six features and changes nothing else: parsing, alignment, rules, reports and exports run as before.
Turn them off#
Admins manage the models in Settings, under AI models:
- Use AI models
- A switch. Off hides every feature below it. "Evidence, rules and reports are unaffected."
- Where they run
- The inference node and your account.
- Models
- The model release and the bundle it came in, with the SHA-256 of the weights.
- What they can read
- "Only what the person using them can open. Export-controlled evidence stays behind the US person check."
- What they never do
- "Change evidence, write a finding, or run a rule nobody created. Nothing is used to train a model."
- Features
- The six features. Edit turns each on or off for everyone.
Each change is recorded in the audit log as Changed AI settings, such as Models off or Reading a raw record off.
In the audit log#
Every accepted proposal is in the audit log with the person who accepted it:
| Action | Detail |
|---|---|
| Saved parser | The columns, the clock and the file it was proposed from |
| Created rule | Version 1.0, with from a suggestion on and the incident |
| Dismissed a rule suggestion | The suggestion and the incident it came from |
| Aligned clock by hand | The offset and bound, ending from a suggested pair |
| Changed AI settings | What was turned on or off |
A finding check and a record explanation change nothing, so they add no entry of their own. Viewing evidence is recorded as Viewed evidence, as always.