AI Chat

Video Walkthrough

A walkthrough of the assistant working from live terminal context — diagnosing a down interface from the output on screen, connecting it to the routing session it took with it, and the provider settings behind it.

Overview

AI Chat is the conversational AI assistant built into NetStacks. It combines your live terminal context, conversation history, and a built-in credential sanitization pipeline so you can ask questions about your network without sensitive data leaking to third-party LLM providers.

AI Chat provides three core capabilities:

• Conversational assistance — Ask natural language questions about network operations. The assistant responds with vendor-specific commands, configuration guidance, and troubleshooting steps tailored to the device you are connected to.
• Command snippets you control — The assistant returns commands as snippets. You insert them into your terminal yourself; nothing runs automatically from a chat reply.
• Automatic credential sanitization — Passwords, SNMP communities, TACACS+/RADIUS keys, routing-protocol secrets, VPN pre-shared keys, private keys, and certificates are detected and replaced with safe placeholders before any data is sent to the LLM provider.

For continuous, hands-on assistance that can drive tools across your session, NetStacks offers two agent modes — Auto Pilot and Overlord. Overlord was formerly called “Copilot.” See AI Modes for how the modes differ and NOC Agents for tool-approval workflows.

How It Works

AI Chat connects your terminal context to your configured LLM provider through a pipeline that injects context, sanitizes sensitive data, and persists the conversation.

Context Injection

When you send a message, NetStacks injects relevant context into the prompt so the model can give accurate, device-aware answers:

• Device information — Device type (for example Cisco IOS / NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS), hostname, and connection details for the active session.
• Session context — Recent terminal output, the command history for the current session, and any text you have selected in the terminal. See Session Context.
• Knowledge base — Relevant documents from your organization knowledge base are retrieved via RAG (retrieval-augmented generation) to ground answers in your own runbooks and standards. See Knowledge Base.

Credential Sanitization

Before any data leaves your environment it passes through the sanitization engine. Pattern-based detection identifies and redacts sensitive information across the major network vendors. Mandatory patterns (vendor and generic credential formats) are always applied; optional patterns for network identifiers are toggled per organization.

Detected secrets are replaced with a plain [REDACTED] token. A few categories use a more specific label so the model still understands the surrounding structure:

Optional patterns cover network identifiers and are off by default. Enable them per organization when you do not want even de-identifying information sent to a provider:

• IPv4 addresses → [IP-REDACTED]
• IPv6 addresses → [IPv6-REDACTED]
• MAC addresses → [MAC-REDACTED]
• Hostnames / FQDNs → [HOST-REDACTED]
• Usernames in config context → [USER-REDACTED]

Organizations can also define custom regex patterns and maintain an allowlist of strings that should never be redacted (matched case-insensitively). Redaction activity can be reviewed through the sanitization audit data in Enterprise deployments.

Conversation Storage

Conversation history persists across sessions so you can return to a previous troubleshooting thread. In Enterprise deployments, conversations are stored on the Controller (PostgreSQL) and tracked per user and session. In standalone use, history is kept locally by the Terminal.

Using AI Chat

Get started with AI Chat in a few steps.

1. Open the AI chat tab — Press Cmd+Shift+A (macOS) or Ctrl+Shift+A (Windows/Linux) to open the AI chat. You can also open it from the AI side panel. This shortcut is rebindable in Keyboard Shortcuts.
2. Ask a natural-language question — Ask about device configuration, troubleshooting steps, protocol behavior, or best practices. For example: “How do I configure OSPF area 0 on this Cisco router?”
3. Review the response — The assistant answers with context-aware guidance based on the device type and your current session state. Commands are formatted as snippets.
4. Insert commands into your terminal — Copy a suggested command into your active session. Commands are not executed for you, so you always review before pressing Enter.
5. Continue the conversation — Ask follow-up questions. The assistant keeps conversation context, so you can refine your approach without repeating background.

Code Examples

Chat interaction: OSPF configuration

Connected to a Cisco IOS-XE router, asking AI Chat for OSPF configuration produces device-specific commands:

User: How do I configure OSPF area 0 on this router with the loopback
      and the two uplinks?

AI:   Based on your Cisco IOS-XE router (hostname: core-rtr-01), here's
      the OSPF configuration for area 0:

      router ospf 1
        router-id 10.255.0.1
        network 10.255.0.1 0.0.0.0 area 0
        network 10.0.12.0 0.0.0.3 area 0
        network 10.0.13.0 0.0.0.3 area 0
        passive-interface default
        no passive-interface GigabitEthernet0/0/0
        no passive-interface GigabitEthernet0/0/1

      This configures:
      - Loopback0 (10.255.0.1/32) as the router-id and in area 0
      - GigabitEthernet0/0/0 (10.0.12.0/30) uplink to dist-rtr-02
      - GigabitEthernet0/0/1 (10.0.13.0/30) uplink to dist-rtr-03
      - Passive-interface on all other interfaces for security

Credential sanitization in action

When you share terminal output containing credentials, the engine redacts sensitive values before sending them to the provider. Note the plain [REDACTED] token used for credentials:

! What you see in your terminal (original output)
username admin privilege 15 secret 0 N3tSt4cks!2026
enable secret 0 Sup3rS3cret#Pass
snmp-server community NetOps-RO RO
snmp-server community NetOps-RW RW
router bgp 65001
  neighbor 10.0.1.2 password 7 08354942071C11
ip route 0.0.0.0 0.0.0.0 192.168.1.1
crypto isakmp key VPN-SharedKey-2026! address 203.0.113.50

! What the LLM provider receives (sanitized)
username admin privilege 15 secret 0 [REDACTED]
enable secret 0 [REDACTED]
snmp-server community [REDACTED] RO
snmp-server community [REDACTED] RW
router bgp 65001
  neighbor 10.0.1.2 password 7 [REDACTED]
ip route 0.0.0.0 0.0.0.0 192.168.1.1
crypto isakmp key [REDACTED] address 203.0.113.50

With the optional IP-address pattern enabled, addresses are also replaced — 10.0.1.2 becomes [IP-REDACTED] and so on.

Troubleshooting prompt: BGP neighbor in Active state

Select show ip bgp summary output and ask the assistant to analyze it. A typical reply:

Observation: 4 BGP neighbors configured in AS 65001
  - 10.0.1.2 (AS 65002) - Established, 450 prefixes received
  - 10.0.1.6 (AS 65003) - Established, 312 prefixes received
  - 10.0.2.2 (AS 65004) - Active (NOT established)
  - 10.0.2.6 (AS 65005) - Established, 89 prefixes received

Neighbor 10.0.2.2 is in Active state. Likely causes:
TCP connectivity failure, AS-number mismatch, MD5 auth mismatch,
or the neighbor is not configured on the remote side.

Suggested next steps:
  1. show ip bgp neighbor 10.0.2.2
  2. ping 10.0.2.2 source Loopback0
  3. show logging | include BGP|10.0.2.2

Custom sanitization pattern

Organizations can add custom redaction patterns for proprietary credential formats. A custom pattern has a name, a regex, and a replacement string (the regex field also accepts the alias pattern):

{
  "name": "internal_api_token",
  "regex": "NSTK-[A-Za-z0-9]{32}",
  "replacement": "[REDACTED]"
}

Custom patterns are stored as part of the organization sanitization configuration alongside the optional-pattern toggles and the allowlist.

Questions & Answers

How does AI Chat protect my credentials?

Every outgoing message and piece of context runs through the credential sanitization engine before it reaches the LLM provider. Pattern-based detection identifies passwords, SNMP communities, TACACS+/RADIUS keys, routing-protocol secrets, VPN pre-shared keys, private keys, certificates, and cloud keys across the major vendors. Most matches are replaced with a plain [REDACTED]; private keys, certificates, and AWS keys use specific tokens like [PRIVATE-KEY-REDACTED]. Mandatory patterns are always on; optional network-identifier patterns are toggled per organization.

Can AI Chat see my terminal session output?

Only the context you provide. The assistant can use recent session output, command history, and any text you select. All of it passes through the sanitization engine before being sent to the provider.

Which LLM providers work with AI Chat?

AI Chat supports Anthropic (Claude), OpenAI, Ollama (locally hosted models), OpenRouter, LiteLLM, and custom OpenAI-compatible (or Gemini-format) endpoints. See LLM Configuration for setup details. One default provider powers every AI surface unless you set an optional per-toolset model override.

When the assistant saves a document, where does it go?

Documents the AI writes (and other auto-generated docs — topology and device/link enrichment, troubleshooting summaries, MOPs, task results, snapshots) go to per-source categories and folders you control under Settings → Documents. Defaults match prior behavior; change any source’s target there.

What was “Copilot”?

“Copilot” was the former name of the Overlord agent mode. There is no separate Copilot panel or shortcut. For an assistant that can act with tools (asking before each action), switch to Overlord; for autonomous operation, use Auto Pilot. See AI Modes.

How do I open AI Chat?

Press Cmd+Shift+A on macOS or Ctrl+Shift+A on Windows/Linux, or open it from the AI side panel. The shortcut is rebindable in Keyboard Shortcuts.

Is my chat history stored, and where?

Yes. History persists across sessions. In Enterprise deployments it is stored on the Controller in PostgreSQL; in standalone use it is kept locally by the Terminal.

Can AI Chat execute commands on my behalf?

No. AI Chat returns command snippets that you insert and run yourself. For automated, tool-driven execution with approval workflows, use the agent modes — see AI Modes and NOC Agents.

Troubleshooting

Related Features

• AI Modes — Auto Pilot and Overlord (formerly Copilot) agent modes and their permission models.
• Command Suggestions — Context-aware command suggestions that complement AI Chat.
• LLM Configuration — Configure providers (Anthropic, OpenAI, Ollama, OpenRouter, LiteLLM, custom), API keys, models, and defaults.
• Knowledge Base — Build a searchable repository the assistant uses for RAG-grounded answers.
• NOC Agents — Autonomous AI agents with tool-approval workflows.
• Session Context — What terminal context the assistant can use and how to control it.