AI Security — beta

AI Security answers three questions: which AI servers run in our networks, which public AI services our people use, and whether someone tries to misuse the FlowPRO AI assistant. All findings go to the Event Center (source AI Security), so notification routing, Scenarios, the Security score and Compliance work with them.

Roles: viewers read; analysts verify, acknowledge, hide and add notes; administrators scan, approve or block, delete, manage MCP and settings. Changes are recorded in Settings → Audit log.

Every hour FlowPRO looks in NetFlow for traffic from our clients to typical AI server ports inside our networks (Settings → Our networks plus private ranges): 11434 Ollama, 1234 LM Studio, 7860 Text Generation WebUI, 8188 ComfyUI, 1337 Jan and the generic 3000, 4000, 5000, 8000, 8080.

• •Port scans are ignored — a source that touches many endpoints with tiny flows is a scanner; only real traffic counts (flows, packets, bytes — Settings tab)
• •Clients must be internal — internet scanners probing a public server are not shadow AI
• •Automatic verification — FlowPRO asks the endpoint for its models (/api/tags, /v1/models, /api/config, /system_stats; GET only, internal addresses only): confirmed AI server / unreachable / not AI
• •Findings — only a confirmed unmanaged server creates a high event; an unreachable endpoint on an AI-only port creates a low "candidate" event; generic web ports appear only when confirmed
• •Workflow — approve (allowed AI), mark as blocked (Scenarios can then block the IP on MikroTik), hide, note; the FlowPRO Ollama itself is shown as managed
• •Asset link — the server and its clients are linked to Assets; the asset detail shows an AI Security card
• •Gone — without qualifying traffic for 14 days the record is marked as gone and later purged (retention)

From Passive DNS FlowPRO recognises 15 public AI services (OpenAI/ChatGPT, Anthropic/Claude, Google Gemini, Microsoft and GitHub Copilot, DeepSeek, Mistral, Perplexity, xAI/Grok, Meta AI, Hugging Face, Cohere, Poe, Qwen, Kimi) and shows which clients use them and how much.

• •A newly seen service creates an event (high for services processing data outside the EU/US, e.g. DeepSeek, Qwen, Kimi)
• •Status — unreviewed / allowed / not allowed; a not allowed service still in use creates a high event (at most once a day)
• •Clients — top clients with DNS query counts, linked to Assets

Every question sent to the FlowPRO AI assistant (NIS2 AI Chat) is checked before it reaches the model. The detector understands Czech, English and Spanish and recognises:

• •Questions about password policies, secrets management etc. are not alarms (built-in exclusions; self-test in Settings)
• •Each event records the user and IP; repeated attempts within 10 minutes increase the counter instead of new events
• •Blocking (optional, Settings) — the user gets a block notice instead of an answer
• •Only the user's own text and explicitly marked external data are checked — never FlowPRO's system prompts

The heatmap shows the 10 OWASP categories for agentic AI (ASI01–ASI10), which of them FlowPRO monitors (ASI01, ASI04, ASI06, ASI10) and where findings are: attacks on AI, untrusted or unknown MCP servers (ASI04) and unapproved AI services (ASI10). The table lists the MITRE ATLAS techniques of the detectors with a link to the ATLAS knowledge base.

A manual inventory of MCP (Model Context Protocol) servers and AI agents: endpoint, transport (http / sse / stdio), trust (trusted / unknown / untrusted), external flag and the tools they offer. MCP has no standard port, so it cannot be discovered from the network. Unknown and untrusted servers count in OWASP ASI04 and the Security score.

• •Discovery thresholds — window, minimum flows / packets / bytes, scanner limit, gone after N days, automatic verification, public AI on/off
• •AI assistant protection — block attacking prompts (from severity), inspect data passed to the AI (indirect attacks), record retention
• •Detector quality — self-test on the built-in CS/EN/ES set (precision, recall) and a box to try any text