# Brain Ask Brain about your logs, metrics, traces and devices, check the evidence behind each answer, and confirm, edit or reject the changes it proposes. Brain is the AI analyst in your workspace. It answers questions by querying your logs, metrics, traces, devices and security data with your own permissions, shows the evidence it used, and turns any change into a proposal that you confirm. ## Before you begin > **Brain needs a model** > > An admin adds a model credential and keeps AI switched on in **AI Settings**. Until then Brain cannot answer. See [Model providers and the AI switch](https://tracix.io/docs/ai/model-providers). ## Open Brain * From any page, select **Brain** in the top bar or press `⌘J` on macOS or `Ctrl+J` on Windows and Linux. Brain opens in a drawer and the page stays under it. On a narrow screen it opens full screen. * For the full chat page, open **AI & Automation › Brain**, or select **Open as page** in the drawer. In the drawer, **New chat** starts over and **History** lists your earlier chats. ## Ask a question Type your question in **Ask Brain…** in plain language, for example "why did checkout-api get slower after 14:00?". Brain plans the queries it needs, runs them through its tools and answers with what it found. A message can be up to 8,000 characters. ### Give Brain context Chips above the message box show what Brain receives with your next message. Select a chip to include or leave it out: * **The page you are on.** A few pages, such as SD-WAN, also send the entities, filters and time range on screen. * **Time range.** Choose **Do not send a time range** to leave it out. * **Packs**, the groups of tools Brain may use. **Packs: auto** picks the packs that fit your page and mentions. Type `@` to mention something by name. You can mention hosts, network devices and interfaces, services, Kubernetes clusters, nodes, workloads and pods, containers, cloud resources, databases, collectors, synthetic tests, endpoints, RUM apps, SD-WAN sites, users, IP addresses, and dashboards, monitors, workflows, cases and visualizations. ### Read the answer Answers can include tables, log lines, charts and links to the evidence. Brain reads with your permissions, so it only finds what you could open yourself. Under a chart, **Show query** shows the query behind it, and **Open in explorer**, when it appears, opens the chart in the matching explorer. To keep the chart, use **Add to dashboard…** or **Save as visualization…**. Saving comes back as a proposal like any other change. ## What Brain sends to your model provider Brain sends your message, the context you included and what its tools return. Tool results are capped before the model sees them, at 50 rows and 12,000 characters each by default, and values that look like secrets, such as passwords, API keys, tokens and private keys, are replaced with `[redacted]`. Calls go to the model and credential set on the Brain profile, which an admin chooses in **AI Settings › Brain**. ## Confirm the changes Brain proposes Brain never changes anything just because a model decided to. Each change comes back as a proposal card that shows: * the tier and the action, such as "Enable monitor"; * the exact target, with its owner and sharing; * the change itself, as a before and after view, or the message a notification would send; * warnings, such as "this monitor pages the on-call rotation"; * a countdown: a proposal expires after 10 minutes. Choose **Confirm** to apply it, **Edit** to change its values first, or **Reject**. A destructive change, such as a delete, asks you to type the target's name before **Confirm** works. Tracix checks your permissions again when you confirm. After a change applies, **Undo** stays on the card for 10 minutes when the change can be undone. | Tier | What it covers | What happens | | ------ | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tier 0 | Reads | Runs at once. No card. | | Tier 1 | Private changes, to objects only you can see | Card | | Tier 2 | Shared changes, to objects your team uses | Card | | Tier 3 | High-impact changes that need a second approver, such as deleting a device | Never runs from chat. Confirming files the change into the approval flow it belongs to, or sends you to the console page where you finish it. The card shows **Routed for approval**. | Code computes the tier from the action, the target's sharing and how much the change touches. The model can raise a tier but never lower it. Network configuration changes and security responses keep their own approvals: Brain files them as a [change request](https://tracix.io/docs/network/ncm/change-requests) or a [response proposal](https://tracix.io/docs/security/response), and the people who approve those decide. While a proposal waits for your decision, the **Brain** button in the top bar shows how many are pending. ## Let Brain apply small changes By default Brain asks before every change. An admin can allow one exception for private, undoable changes: **1. An admin allows auto-apply** In **AI & Automation › AI Settings**, open the **Brain** tab and turn on **Allow auto-apply** under **Trust and review**. **2. You choose Auto-apply** In the message box, switch the mode from **Ask first** to **Auto-apply**. Your browser remembers the choice. **3. You ask in your own words** A tier 1 change that you ask for in a message you typed, such as creating a private dashboard or monitor, then applies at once with **Undo** for 10 minutes. One message applies at most three changes this way. Everything else, including any change you did not ask for, still comes back as a card. ## What Brain can never do Brain has no tool that changes AI settings, MCP servers, skills, credentials, roles, members, API keys, SSO or enrollment, and none that applies data lifecycle changes or edits audit records. No Brain tool can approve, reject or resume anything: approvals always belong to a person. ## Memory and sharing * **Memory.** Brain keeps short notes for each person, such as "show device names, not IPs", up to 40 notes of 200 characters, and defaults such as the time range every page starts on. It saves a note on its own only when the note comes from something you typed, and offers **Undo**. Open **Memory** in the drawer to review notes, **Forget** one or **Forget everything**. Memory is private to you, and an admin can turn it off with **Per-user memory**. * **Sharing.** Select **Share chat** to share a chat with up to 50 people in your workspace who can already see everything in it. They get a read-only copy up to the newest message: nobody can post in it or act on its proposals, and charts query again with the viewer's own permissions. There is no public link. ## Settings for admins Admins set up Brain in **AI & Automation › AI Settings › Brain**, which has three sections: **Profile**, **Ledger** and **Entity index**. Changing them needs permission to manage AI settings. | Profile setting | What it does | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | **Model** | The provider, model and credential Brain uses, and a lighter model for routing and titles. An empty model uses the preferred model. | | **Instructions** | Text added to Brain's instructions for your workspace, up to 8,000 characters. | | **Enabled packs** | The tool packs Brain may use in this workspace. | | **Allow auto-apply** | Lets people use **Auto-apply**, described above. Off by default. | | **Transcript review** | Lets admins read chat transcripts. The chat header tells people when it is on. Off by default. | | **Per-user memory** | Turns memory on or off for everyone. On by default. People can still review and delete their notes. | | **Allow SQL** | Gives Brain a read-only SQL query tool. On by default. | | **Max iterations** | Tool-call rounds per answer, from 1 to 30. 12 by default. | | **Daily budget (USD)** | Brain's spend cap for the whole workspace each day. 0, the default, means no cap. | | **Retention (days)** | Chats older than this are deleted, from 7 to 365 days. 90 by default. | The **Ledger** records every tool call, proposal, decision, change, undo and routing on a hash-chained record. Filter it by action, export it as CSV, and select **Verify chain** to check that no entry was changed or removed. ## Next steps - [Model providers and the AI switch](https://tracix.io/docs/ai/model-providers): Choose the model Brain runs on - [Workflows, agents and Auto-Fix](https://tracix.io/docs/ai/workflows): Turn a question into an automation - [Problems and cases](https://tracix.io/docs/alerting/problems-and-cases): Ask Brain about a problem