AI Access

Use the existing AI settings to onboard a provider; no separate setup wizard is required. Saving a connection does not install an inference server or prove that its model produces reliable investigations.

Choose the owner

Use a team connection for shared team billing, or an installation connection for a centrally operated on-prem cluster. A PacketSafari API key authenticates CLI jobs; the AI-provider credential pays for and authenticates model requests. They are different keys. See API keys.

Add the provider connection

1. Select Add connection and choose the API-key connection option.
2. In Connection, enter a recognizable name, select the provider, and check its base URL. Use the OpenRouter provider for its hosted API; use the matching compatible provider for a customer-operated inference endpoint.
3. Enter the provider credential. On-prem deployments also offer No authentication (local endpoint) where appropriate for the protected local service. Keep the connection enabled and select Save connection.
4. Complete endpoint approval if required. The endpoint must be reachable from PacketSafari's backend and workers, not just the administrator's browser. Container-local localhost is not the inference server on another machine. Follow egress approval and private CA configuration for customer-managed endpoints.
5. Reopen the connection's Models tab. Select Refresh models, or Add model by ID when discovery is unavailable. Enable the intended models, choose the Default model, and save the connection.

Credentials are not returned to the browser. Leave an existing key blank to keep it when editing. A successful model listing establishes discovery only; it does not prove inference credits, tool calling, or report quality.

Grant access and set defaults

Connection permission and model permission are separate:

• In an installation connection's Access tab, grant All eligible workspaces or Selected teams and accounts. Saving a model alone does not grant the team access to its provider connection.
• Under Defaults & access, installation administrators control whether shared team connections are allowed. Team administrators manage member AI permissions, including Qualified model selection for selecting exact models.
• Under Installation AI models, installation administrators can add or customize a model, choose its allowed workflows and Available to audience, and save. A permitted connection still cannot run a disabled or ineligible model.
• On Providers, select Use as default for the intended connection. Review workload assignments and backups under Defaults & access: a workload override can select a different connection/model from the general default.

Require passing validation and Enable without validation are distinct model access policies. The latter is an administrator's explicit permission to use the route; it does not turn a failed or untested model into a validated one. Changing defaults applies to subsequent requests and does not migrate active runs.

For an offline deployment, select only local connections in defaults and workload backups, disable cloud fallback permissions, and enforce the intended egress policy. A local primary model alone does not establish offline-only operation.

Reasoning and capacity presets

Use Model details to inspect the model profile. For installation presets, use Customize in Installation AI models to review or import the profile. Match token limits, API dialect, tool/reasoning parser, and model/server revisions to the endpoint that actually serves the model.

A profile can declare model_profile.reasoning.default_effort, which must occur in supported_efforts for provider_native or effort_mapping reasoning. To edit this value, export the existing model entry using Import / export JSON in Installation AI models, modify its model_profile.reasoning.default_effort, then Import draft, review and save. Preserve the other profile fields and use an effort already supported by the exact route; import alone does not save or test it. Explicit run settings override this default, including saved CLI reasoning and UI selections. An omitted value uses the model default where declared, otherwise the existing workflow fallback. Unsupported effort levels should not be invented for a model that does not expose them.

The shipped OpenRouter Nemotron preset is nvidia/nemotron-3-super-120b-a12b: Medium reasoning by default, with Low and Medium advertised. It is available under administrator-enabled policy, but its retained Fast tests are not production-quality qualification. The hosted profile is not a validated offline preset. A local installation needs its own served model ID, actual token limits, parser/revision details, and validation.

Model token limits describe a request envelope, not a GPU capacity guarantee. There is no automatic per-model concurrency-sizing wizard. Start acceptance with one active investigation, then measure memory, queue time and failures at the intended concurrency. Configure admission/queue capacity on the inference server and size PacketSafari worker capacity with the deployment administrator. Do not copy hosted context limits to a local server unless it supports them.

Validate before team rollout

The Health test is not a tool-call or structured-report qualification. A passing synthetic validation is not proof of analysis accuracy. Do not silently weaken validation policy to resolve a failure; investigate the reported incompatibility.

For acceptance, use a known benign capture, a known security case, and a troubleshooting case with an expected cause. Check readable Markdown and JSON, exact packet references, limitations, recommended action, cancellation, and the intended simultaneous load. For security without an alert, confirm assessment.alertVerification.applicable is false, even if the traffic is suspicious. Record endpoint/model revisions, settings and results before calling the preset tested. Revalidate after material runtime/profile changes.

Use the same connection from the CLI

After creating a PacketSafari API key and saving the server URL, use the guided selector to choose an available provider and model:

packetsafari investigate "$HOME/Desktop/incident/capture.pcap" --goal security --workflow fast --tui

Replace the path with a real local capture. For repeatable submissions, save the actual connection source ID from your deployment. Do not reuse another team's ID. The Investigations API guide describes source/model discovery. For a connection offering the hosted Nemotron model:

packetsafari config set ai-auth-source-id 'YOUR_AI_CONNECTION_ID'
packetsafari config set model nvidia/nemotron-3-super-120b-a12b
packetsafari config unset reasoning-effort
packetsafari config show
packetsafari investigate "$HOME/Desktop/incident/capture.pcap" --goal security --workflow fast --format json

Unset any PACKETSAFARI_REASONING_EFFORT environment override and omit conflicting AI values from a --settings file to inherit the model's reasoning default. To inherit the connection's default model as well, run packetsafari config unset model and remove model overrides. Use --format markdown for the readable export. See CLI configuration precedence.