Security
Use cases › Security puts a model the tenant can call to work on three things: your code, the Olympusx AI audit log, and your own log stores of firewall, network and sign-in events. It reports what it finds as findings a person reads, dismisses with a reason, or exports. It reads and recommends; your people change code, deploy rules and act on accounts. When a verdict proposes an action, such as disabling an account, the action waits for a person’s approval.
| Job | What Olympusx AI does | Page |
|---|---|---|
| Code | Reads a repository the Code Assistant indexes and reports what looks exploitable, with the lines and a suggested fix. | Code assessments |
| Questions about activity | Answers a question about a window of time from the audit log or a log store, in a few bounded rounds of read-only queries, and gives a verdict that cites the events. | Investigations |
| Daily checks | Runs three preset questions over the audit log once a day. | Hunts |
| Your logs | Reads your OpenSearch or Loki in place, read-only, during an investigation. | Log sources |
| Your alerts | Opens an investigation for each alert your Alertmanager or SIEM posts. | Alert integration |
| Results | Keeps code and log findings in one list, de-duplicated, with dismissals that persist. | Findings |
| Decisions | Holds a proposed action until an admin approves or rejects it. | Actions and approvals |
| Hand-off | Exports code findings as SARIF; drafts a Sigma rule for your SIEM. | Exports |
Every finding is reasoned only: a model argued it from the code or the events it was shown. A person checks a finding before acting on it.
Who can open it
Section titled “Who can open it”| Role | Overview | Findings | Investigations | Sources |
|---|---|---|---|---|
| Admin | Read | Code and log findings; dismiss and reopen | Start investigations; turn hunts on and off; approve or reject actions | Start and stop assessments; add, test and remove log sources; turn alerts on |
| Builder | Read | Code findings; dismiss and reopen | Not available (the tab is disabled) | Start and stop assessments |
| Auditor | Read | Code and log findings, read only | Read investigations, hunts and actions | Read repositories, assessments and log sources |
| End user, Reviewer | Cannot open the page | |||
| Platform admin | As an admin, in any tenant they pick with the tenant picker |
Investigations and log findings quote the audit log, so they are for the roles that read it: admins and auditors. Approving an action that disables an account needs the right to manage people, which only admins hold. See Roles.
What you see
Section titled “What you see”The header names the page and carries a tenant picker. Below it are four tabs:
- Overview — what Security does, and a status list of what this install has for it today: A model to review code (how many of the tenant’s models are large enough), the Guardrail policy, Assessments of your repositories and Approval by a person, each with a link to where it is set.
- Findings — every open finding, code and log, the most severe first. See Findings.
- Investigations — the Hunts, then every investigation with its question, window, verdict, findings, model and tokens. See Investigations.
- Sources — the Repositories the Code Assistant indexes, the Assessments of them, and the Log sources investigations can read.
A finding opened from the list replaces the tabs with its detail page.
Which model to use
Section titled “Which model to use”Finding a vulnerability and arguing that it holds works best with a large model, so choose one of 30B parameters or more. Olympusx AI treats a model of 30B parameters or more, or any model from a connected provider, as able to review code, lists those first, and marks smaller ones (may be too small to review code). The line is guidance, not a gate: you can choose any chat model the tenant can call. A model’s tokens count against its budget and the tenant’s. See Deploy a model and External models.
Reasoning models think for minutes before they answer. A platform admin sets how long one model call of Security may run; see Settings and limits.
A first result in five minutes
Section titled “A first result in five minutes”You need a repository the Code Assistant indexes (see Code sources) and a chat model the tenant can call. As an admin or a builder:
- Open Use cases › Security and select the Sources tab.
- Under Repositories, find the repository and select New assessment.
- Choose a Model, leave Read tests and examples too off, and select Start the assessment.
- Watch Batches count up under Assessments. When the status is Finished, select the Findings tab.
- Open a finding: read Why it may be exploitable, The code and the Suggested fix, and either fix it or Dismiss it with a reason.
As an admin, for an investigation instead: on the Investigations tab, select New investigation, choose a starter question such as “Was an API key created and then used from an address not seen before?”, choose The last 7 days and a model, and select Investigate.
How Security hands work to people
Section titled “How Security hands work to people”- Suggested fixes are text for your developers to apply in your repositories.
- Your logs stay in your stores: Security queries them where they are, during an investigation, and keeps only what it found.
- A drafted Sigma rule is text for a person to review before it goes into your SIEM.
- A disable proposal waits for an admin, who approves or rejects it.