Augur & AI
Configure the on-prem model, then use it: risk scoring in the Sentinel Dashboard, SOAR in the Playbook Builder, identity attack-path analysis in Blast Radius, and an administrator Fidwyn LLM that previews before it applies.
- An OpenAI-compatible model backend reachable on a loopback or private (RFC 1918) address, typically a local runtime on a GPU host.
- An Augur entitlement in your license.
- Signals to score: assets onboarded and sessions being recorded (see Administration).
- For playbook actions (revoke, disable, quarantine): the affected users and endpoints under management.
1 · Configure the on-prem model (AI Settings) ¶
Fidwyn bundles a model into the appliance image and serves it from your own GPU. Turn Augur on in three moves:
- Activate the entitlement. Confirm Augur is enabled in your license (Get started → License).
- Point at the backend. Under AI Settings, enter the OpenAI-compatible endpoint, a local runtime warmed into the GPU. Endpoint validation rejects any address that is not loopback or private (RFC 1918), at both configuration and call time, so an inference call has no path off the appliance.
- Confirm reachability. Run the built-in check; once green, scoring and the assistant come online.
2 · Score risk (Sentinel Dashboard) ¶
The Sentinel Dashboard fuses signals into a per-identity risk score from 0 to 100 (high-risk at 75). Open any score to see its SHAP breakdown, a base rate plus the per-signal contributions that moved it, alongside the MITRE ATT&CK techniques each signal maps to, from a locally-baked, air-gapped threat-intelligence bundle.
3 · Automate response (Playbook Builder) ¶
Build a playbook as a boolean trigger tree, using all of, any of and not of, over signal type, severity, risk score, time window, role, and MFA state, wired to actions: revoke tokens, force MFA re-authentication, quarantine an endpoint, disable a user, notify, or forward to your SIEM. Playbooks are versioned YAML and carry inline compliance mappings. Use test-trigger to evaluate a playbook against the last 24 hours of real signals without writing to the database.
4 · Map blast radius (Blast Radius) ¶
Blast Radius rebuilds the identity graph and scores, for each identity, how far it can reach if compromised, fusing Active Directory attack paths and pass-the-hash exposure into a 0–100 score, with the reachable-system count, the top path to a tier-0 target, and the change since the last run.
5 · Use Fidwyn LLM (preview then apply) ¶
Ask Fidwyn LLM, in plain language, to make a change. It resolves the users and assets, drafts the action, and returns a preview with a short-lived apply token. Nothing executes until an administrator confirms. On confirmation Fidwyn LLM runs the change through the same access resolver a human would use and writes it to the audit trail. Secrets are never parsed from the conversation. A credential is always forced into a masked field, by policy.