Quickstart: Activate Intelligence
From configuring SLM providers to handling your first remediation approval — the full setup in 6 steps, in under 20 minutes.
Verify Your AI Provider
| Provider | Recommended model | Cost / 1M tokens | When to use |
|---|---|---|---|
| **Anthropic** | Claude Haiku 3.5 | $0.80 / $4.00 | Default — best price/quality ratio |
| **OpenAI** | `gpt-4o-mini` | $0.15 / $0.60 | Cheapest; slightly weaker on edge cases |
| **Google** | Gemini 1.5 Flash | $0.075 / $0.30 | Cheapest at scale; multimodal capable |
| **Groq** | Llama 3.1 70B | $0.59 / $0.79 | Sub-100ms inference for live triage |
| **Ollama (local)** | `llama3.2:3b` | $0 (self-hosted) | Data sovereignty / air-gapped |
Enable SLM Analysis
Go to Admin → Neural Bus → Settings and toggle enableSlmAnalysis. This switches the engine from deterministic-rules-only mode to deterministic-rules-plus-semantic-analysis.
What changes:
- Complex event clusters (>5 related events within a window) get dispatched to the SLM for semantic correlation
- Patterns previously invisible to rule engines (e.g., "several login failures from related-but-different IPs in the same network range") become detectable
- AI usage logs start appearing in your AI usage dashboard — you can budget-cap by tenant
Privacy guarantee: before any payload reaches the SLM, it passes through a strict sanitization pass. Sensitive fields (passwords, tokens, credit-card-like strings, SSN patterns) are redacted. PII never leaves your tenant.
Configuration is managed through the Admin UI — change the toggle in Settings → Neural Bus and it takes effect on the next config refresh. You can read the current configuration via GET /api/neural-bus/config. AI provider + model are inherited from the platform AI gateway you configured in Step 1; sanitization mode + budget caps live in the same settings panel.
Configure Remediation Approvals
| Setting | What it controls |
|---|---|
| `remediation.autoRemediateEnabled` | Master switch. Off → every remediation is queued for manual action, regardless of severity. |
| `remediation.autoRemediateSeverities` | Which pattern severities are allowed to auto-execute (default: `critical`, `high`) when the matching template doesn't require approval. |
| Template's `requiredApproval` | `none`, `admin`, or `super_admin` — fixed per template (e.g., blocking a brute-force IP needs none; suspending a user needs `admin`). Not admin-editable today. |
Monitor the Dashboard
The Neural Bus Dashboard (Admin → Neural Bus) gives you the live operations view:
- Events stream — real-time feed of platform events being ingested
- Pattern queue — recently detected patterns ranked by severity + confidence
- Pending remediations — proposed actions awaiting approval
- Active correlation rules — rules currently running with hit-count metrics
- SLM spend — daily/weekly/monthly AI token spend
- Resolved incidents — history of past patterns that fired remediation
Set up alerting on dashboard health:
- Pattern detection rate suddenly drops → something's off in the event-bus (no events arriving)
- SLM spend nears cap → reduce sanitization aggressiveness or rotate to cheaper model
- Pending-remediation queue grows unbounded → approver bandwidth issue
Build Custom Correlation Rules
Built-in rules cover the obvious cases (login-failure clustering, error-rate spikes, slow-query patterns). Inspect what's currently active via GET /api/neural-bus/rules — the response includes each rule's hit count, last-fire time, and current configuration.
For domain-specific patterns, file a feature request through Forge — the team ships new correlation rules in platform releases so all tenants benefit from the same detection improvements.
Rule shapes worth knowing:
- Threshold rules — N events match within window → fire
- Sequence rules — events A → B → C in order → fire
- Anomaly rules — Z-score against historical baseline crosses threshold → fire
- Cross-tenant aggregations — same pattern across multiple tenants (platform-wide signal)
Rule authoring is sandboxed — your rule can't access cross-tenant data or escape its own correlation window.
Integrate the Agent Palette
The Agent Palette is the operator's command surface. Hit Ctrl+Enter from anywhere in the admin and type a natural-language command. The Neural Bus parses intent and either routes or fetches.
``` "Show me critical patterns from today" → Routes to /admin/neural-bus?severity=critical&date=today
"Find all failed payments for tenant ACME" → Runs a CRM + Commerce query, displays results inline
"What's our checkout abandonment rate this week vs last?" → Queries BI; renders the comparison
"Block IP 203.0.113.42 at the WAF" → Proposes a remediation; requires approval if your role lacks auto-approve ```
Customize the palette:
- Intent parsing flows through
POST /api/neural-bus/parse-intent— the SLM converts natural-language input into a routed action (navigate, query, remediate, schedule) - Configure intent-routing rules under Settings → Palette → Intents
- Theme + keybinding (Ctrl+K, Ctrl+J, etc.) configurable per-user
The palette runs under the same RBAC as the rest of the admin — a user can't trigger commands they wouldn't be able to do via the regular UI.
Integration Recipes
Sentinel → Neural Bus correlation. Camera + access-control events from Sentinel flow into the Neural Bus. Patterns like "5 access-denied events at the same door within 10 minutes" trigger an on-call notification automatically.
Helpdesk → Neural Bus. When ticket-volume spikes for a specific product / category, the Neural Bus surfaces it as a "potential incident" — saves SRE the dashboard-scanning labor.
Forge → Neural Bus. Production bug reports flow to Forge automatically. If similar bugs cluster (same stack trace, same module, related symptoms), Neural Bus proposes consolidating them into a single tracked issue.
Claw + Neural Bus = the autonomous SRE. AeionClaw can subscribe to Neural Bus patterns and propose / execute remediations through the Claw skill system. Configure under Claw → Reactions → Neural Bus Patterns.
Custom dashboards via BI. Neural Bus's pattern history and remediation outcomes are first-class data in Aeion BI. Build custom dashboards for engineering leadership without writing custom scripts.
Troubleshooting
No patterns being detected. Check that the event bus is healthy (Admin → Neural Bus → Health). If events are arriving but patterns aren't firing: (1) verify SLM analysis is enabled, (2) check pattern thresholds aren't too aggressive, (3) confirm correlation windows are large enough for your event velocity.
SLM spend approaching cap. First-line: switch to a cheaper model (gpt-4o-mini or gemini-flash). Second: increase the deterministic-rule coverage to reduce events needing SLM analysis. Third: increase sanitization aggressiveness (more strict redaction → smaller payloads → fewer tokens).
Remediation approval queue backing up. Approver bandwidth is the bottleneck. Lower-stakes approvals can be batched ("approve all medium-severity from this rule for the next hour"). Or auto-approve high-confidence remediations (Settings → Approvals → Auto-approve threshold).
Pattern fires too often (noisy). Tune the threshold or correlation window. For thresholds, increase the count. For sequence rules, add intermediate steps that filter false positives. For anomaly rules, increase the Z-score gate.
Custom rule not firing. Verify the rule is registered (Admin → Neural Bus → Rules → status: active) via GET /api/neural-bus/rules — check the rule's hit count and last-fire time. Confirm events match the trigger list (event names + payload shape) and that thresholds/windows aren't set tighter than your actual event velocity.
Frequently Asked Questions
No. Before any event payload reaches an SLM, the Neural Bus runs `sanitizePayload`. Hardcoded sensitive keys (passwords, tokens, credit card numbers, SSN patterns) are redacted. PII never leaves your tenant. Sanitization is configurable (strict / balanced / minimal) per tenant.
The built-in catalog ships threshold, sequence, anomaly, and cross-tenant rule types — inspect the current set via `GET /api/neural-bus/rules`. New correlation rules ship in platform releases so all tenants benefit from the same detection improvements; file a feature request through Forge if you have a domain pattern the built-in set doesn't cover.
Every remediation plan is recorded and queryable via `GET /api/neural-bus/remediations`, and it's visible in the Neural Bus dashboard's resolved-incidents view. Remediation steps that include a notification action (most templates do) dispatch through the platform's notification system, which you configure once and reuse across modules.
Deterministic rules detect explicit patterns ("error rate > N in window W"). SLM analysis detects semantic patterns invisible to fixed rules ("5 different login failures with related-but-different IPs in the same ASN — probably credential-stuffing"). Both run in parallel; SLM only fires on event clusters where rules didn't already catch the pattern.
Yes. Set the SLM provider to Ollama (local) and use a self-hosted model (`llama3.2:3b` is a good default). No external API calls. Deterministic rules + local SLM analysis give you the same capability surface without any cloud dependency.
There's no separate after-hours escalation policy today — the same `autoRemediateSeverities` and per-template approval requirement apply around the clock. If a `none`-approval template matches an auto-remediate-eligible severity, it runs immediately regardless of time of day; anything requiring `admin`/`super_admin` approval waits in the queue until an authorized user approves or rejects it via the dashboard or the approve/reject API.
Yes — that's the design intent. Anomaly rules baseline against historical metrics (P95 latency, error rate, queue depth, etc.) and fire on deviation. With a tight rolling baseline and a sensitive deviation threshold, the Neural Bus can surface emerging issues well before they become customer-visible.
Chatbots focus on conversation; the Agent Palette focuses on action. Commands route to actual operations (navigate, query, remediate, schedule) under the operator's RBAC. It's the "Ctrl+K everywhere" UX adapted to a multi-tenant business platform.