Connect an AI model for your IOC searches
GoChannel Desk works with a cloud AI provider through a standard API endpoint, with a model running on your own PC, or with the built-in model. The choice matters. It decides where the log lines inside a prompt go, which counts when logs hold usernames and IP addresses.
Three ways to connect a model
A cloud AI provider
A cloud AI provider connects through a standard API endpoint and suits larger log folders or harder reasoning. Prompts go to that endpoint, so any log lines the agent includes leave your PC. Secrets in tool output are redacted before they reach the model. Logs hold personal data. Ordinary log lines with usernames and IP addresses still go to the endpoint, so check your organisation's rules first.
A model on your PC
A model running locally on your PC keeps everything on the machine: with a local model nothing leaves it, which fits logs with usernames and addresses and incidents you must keep private. Speed and quality depend on your hardware and the model you run. Test it on harmless sample logs first.
The built-in model
The built-in model is the option to try when you have no endpoint or key to hand. Quality varies. Review its output like any other model's, and follow your organisation's rules for personal data before you give it sensitive log copies.
Check the endpoint with Test
The Test button checks an endpoint before you rely on it. It shows the response time and the context window, which tells you how much log text fits into one request. Test again after changes. A small window means you should give the agent smaller files or one folder at a time.
Choosing a model for log searches
Use a bigger model for steps that need judgement, such as correlating hits across several log files or drafting the findings note, and a smaller one for narrow edits like restoring defanged text in iocs.txt. run_on_model sends one hard step to a bigger model while the rest of the task stays on your default. Mix them.
Quality varies between models. Review every diff and every search result yourself, and use Ask first when you try a new model so each change waits for your OK. A clean result never proves a system is clean.
