Salem Cyber Doc Site
  • 🏠Documentation Home
  • ✨Initiation Guides
    • Quickstart: Deploy Salem
    • Admin Guide
    • Installing Teams App
    • Installing Browser Extension
    • Feature Overview
  • ✨General Guides
    • Managing Alerts
    • Managing Questions
    • Threat Notification Management
    • Uploading Files
    • Logical Operations
  • ✨Configurations Specification
    • Configuration Home
    • Action Conf
      • "match" ActionConfs
      • "webhook" ActionConfs
      • "llm" ActionConfs
    • Action Definition
      • Azure Log Analytics
      • Microsoft Graph API
      • Splunk Search
      • Bring Your Own LLM
    • Parsing Conf
      • Summary Details
    • Report Conf
    • LLM Configuration
  • 💾Changelog
    • Dec 5th '24: Get cracking on your holiday shopping list
    • July 18th, ’24: Beat the heat and the hackers
    • Apr 17th, '24: Alert showers make analysts sour... no longer with Salem!
    • Mar 5, '24: They're after me (and your) secure systems! We're na-tur-ally suspicious
    • Jan 31, '24: New year, new me... and a new way to extract data from your alerts
    • Dec 21, '23: Jingle bells, WannaCry smells, your escalated alert just laid an egg
    • Nov 14, '23: Stuff the turkey or stuff cyber alerts with context... Why not both?
    • Oct 25, '23: Llama, llama on the wall which alert is scariest of them all
    • Sept 19, '23: Context building via true positive/false positive workflow
    • Sept 1, '23: Alert report UI, webhook actions, and question upgrades
Powered by GitBook
On this page
  • Supported LLMs
  • Salem LLM Features
  • "Ask Salem" ActionConf Configuration
  • 1. ActionDefinition Name
  • 2. ActionConf type
  • 3. Disabled
  • 4. Parameters
  1. Configurations Specification
  2. Action Conf

"llm" ActionConfs

Previous"webhook" ActionConfsNextAction Definition

Last updated 11 months ago

"llm" actions are created by default to support the LLM features embedded in Salem. Admins can modify the response from an LLM request by editing the specified ActionConf for a Salem feature. To update the ActionConf, the user can access via the Admin menu by entering view -a in Salem Chat and then selecting Configs > ActionConfs.

  • OpenAI - Chat GPT

  • "Ask Salem" :

    • id: "AskSalem",

The image below is Salem's default LLM ActionConf. More general information on ActionConf construction and their purpose can be found in the documentation.

The feature name defined that uses the ActionConf. The name of the ActionConf must match this value exactly or the app will not identify the ActionConf and will return the LLM error card.

The type of ActionConf that is defined. LLM ActionConfs expect a value of "llm."

A 1 or 0 value for whether the action is currently in operation. By default, the ActionConf is disabled (value of "1") and must be updated by a Salem admin.

Required inputs that match to a corresponding ActionDefinition. The definition must match the name of an ActionDefinition and "temperature" and "additional_instructions" must match the input_keys of the ActionDefinition or the request will fail.

  • definition - The name defined in the "definition" must match the corresponding LLM's ActionDefintion, or the request will fail (in this case, Salem expects an ActionDefinition with the name "External LLM")

  • temperature - Temperature is a hyperparameter that controls the randomness of the output of a large language model (LLM). It is a value between 0 and 1, with a lower temperature resulting in more deterministic and factual output, and a higher temperature resulting in more creative and imaginative output.

  • additional_instructions - An editable prompt that will append to the end of the coded "instructions" for the Salem feature. This field can be an empty string.

  • outputs - not in use

✨
1.
ActionDefinition Name
2.
ActionConf type
3.
Disabled
4.
Parameters
Action Conf
Supported LLMs
Salem LLM Features
"Ask Salem" ActionConf Configuration