caver Intelligence is a chat-style admin orchestrator built into the caver platform. Type a natural-language command and the planner decomposes it into tool calls against the live stack: search, write configs, author CAVERN rules, backtest against 90 days of history, generate compliance artifacts. Every step is audited as an OCSF 6003 event.
Each primitive is a discrete, audited tool call. The planner chains them to complete multi-step operator requests. All calls require explicit approval before dispatch.
onboard_sampleoperatorWalk through adding a new log source end-to-end: collector config, OCSF mapping, index setup, smoke-test search.
nl_to_configoperatorConvert a natural-language description of a desired behavior into a caver.toml or collector pipeline stanza.
forge_ruleoperatorAuthor a new CAVERN detection rule from a threat description, CVE, or ATT&CK technique. Commits to the rules store.
replay_against_historyoperatorBacktest a proposed rule or SPL query against up to 90 days of stored events. Returns match count and sample hits.
lint_configoperatorValidate a caver.toml, collector pipeline YAML, or CAVERN rule file against the current schema before deployment.
enrich_textoperatorResolve IOCs, CVEs, vendor names, and ATT&CK identifiers inline. Returns structured enrichment data from the TI feeds.
explain_rule_silenceoperatorDiagnose why a CAVERN rule has not fired in a given window. Checks index presence, field mapping, threshold config, and schedule.
tune_thresholdoperatorAnalyze a rule's recent fire rate and false-positive ratio, then propose and apply a new threshold or risk-score adjustment.
start_canaryoperatorDeploy a rule or config change to a designated canary search peer before rolling it to the full fleet.
pipeline_diffoperatorCompare two caver-collector pipeline configs (e.g., staging vs production) and surface semantic differences.
compliance_reportoperatorGenerate a point-in-time compliance artifact: enabled rules, covered ATT&CK techniques, coverage gaps, and data-retention status.
searchfoundationRun an SPL, KQL, LogQL, ES|QL, or SQL query against the OCSF Parquet lake. Used internally by most operator primitives.
write_configfoundationAtomically write or update a config file in the live caver config store. Requires MANAGE_INTEL capability. Always audited.
Operator session screencast coming soon. Watch a new operator go from “I'm adding Zscaler proxy logs” to a deployed source config, a custom CAVERN rule, a backtest against 30 days of history, and a canary rollout in under 10 minutes. Sign up for evaluation access and we'll send the recording when it ships.
caver Intelligence ships as part of the main caver commercial license. LLM inference costs are operator-supplied via your own API key. Contact [email protected] to start an evaluation.