Overview

Empowered AI is a advanced module of Energy Logserver platform, designed to enhance event detection, correlation, and data analysis across IT and OT environments. It combines mathematical data-analysis methods together with language-model-based detection, creating a powerful and comprehensive analytical engine.

The module uses statistical techniques to identify anomalies, recognize behavioral patterns, and detect deviations that may indicate security incidents or system failures.

A key component of Empowered AI is the use of Large Language Models (LLMs), including our dedicated on-site extension “AI on Prem”. This technology enables local execution of language models within the customer’s environment, ensuring no data leaves the organization. As a result, Empowered AI delivers advanced semantic detection, event classification, and automated analytical support while maintaining full data privacy and security compliance.

By combining mathematical precision with contextual understanding from language models, Empowered AI provides a modern, multi-layered approach to detection and analytics in complex log environments.

Imporant to note that Use Cases can work in batch or in realtime - connected to Network Probe pipeline.

Empowered AI is an ongoing project, continuously improved by a team of mathematicians, data scientists, and security analysts.

Use Cases

In the Empowered AI section you will find a summary of the existing use cases, connecting rules and data to work with. At the top, you’ll find the total number of configures cases and the number of scheduled and unscheduled cases. Here is the search field and buttons Refresh, and Create and Upload.

Table contain the following collumns :

• Use Case - unique name for the rule running on selected data

• Category - given category name upon create

• Index Pattern - data to work with

• Last Executed - date when last use case was Executed

• Last Modified - when last use case configuration was changed

• Method - selected algorithm

• Schedule - configuration of scheduling options

• Status - current calculation status

• Profress - progress bar in %

• Action - additional use case management

Status

The rule has one of the following statuses:

• Waiting to start - Run once rule starts by clicking symbol play

• Scheduled - the scheduled rule starts automatically

• Scoring

• Building

• Finished

• Error - check error details in the results preview

Actions

Icons of actions:

• Play – run or rerun the rule

• Stop – unschedule periodic rule, after this action rule type changes to Run Once

• Pencil - edit the rule’s configuration

• Bin – delete the rule

• Download - get the full usecase, rule definition and its config

Create Use Case

The first step in the data analysis process in the Empowered AI module is to properly prepare the data and input it into an analytical rule using saved searches as data sources.

1. Log in to the application and access the Discover module.

2. Select the data source you want to analyze (e.g., system logs, application records).

3. Set filters and search criteria to narrow down relevant data (kql/oql not supported).

4. Add a field as a column, which allows selecting the field during rule creation.

   

5. Save the search by clicking the Save button, naming your search, and clicking Save again.

   

Defining Data Source in the Empowered AI Module

1. Go to the Empowered AI module.

   

2. Select the AI Rules tab and click Create New Rule or edit an existing rule.

3. In the Choose Data Source section, select the saved search you created earlier.

   

4. After selection Index Pattern and query will be automaticly filled up based on saved search. Alternatyivly you can skip saved search and fill up index pattern and query by yourself.

   

5. Time Field will be fetched automatically from your Index Pattern.

Configuring the Analytical Rule

1. Name your rule in the AI Rule Name section.

2. In the Field to Analyse section, select the data field you want to analyze.

   

Configuring the Scheduler

The rule can be run immediately using the Run Once option or cyclically using the Scheduled option.

1. For Run Once analysis, provide the “Build Time Frame” learning period and the analysis start time using the trained model “Start Date”.

   

2. For Scheduled analysis, choose the run frequency (e.g., every hour, day, week, or month). Specify the learning period and the “Start Date Offset” for the data range to be analyzed.

   

3. Actual Log Count: Displays the number of logs to be analyzed.

   

Accessing the Performance Tab

1. Log in to the application and navigate to the Empowered AI module.

2. Select the AI Rules tab and click on the rule for which you want to view the performance.

3. The Performance tab will open, displaying detailed analysis results.