Basic Configuration

After initial deployment, it is recommended to complete configuration in the following order.

1. LLM Provider

Add at least one enabled LLM Provider in system settings.

Tags can be used to distinguish model capabilities such as fast, powerful, tool_calling, structured_output.

It is recommended to configure at least one Provider with the structured_output tag, otherwise AI investigation and knowledge extraction may not work.

2. SIEM

Configure Splunk or ELK in SIEM for subsequent log search, Harness Agent investigation, and ELK Index Action.

If Harness Agents need to query SIEM, you also need to maintain SIEM YAML index configuration.

3. Threat Intelligence

After enabling AlienVault OTX or OpenCTI in Threat Intelligence, the Threat Intelligence Enrichment Playbook can write IOC query results and threat context into Artifact's Enrichment.

4. LDAP

If enterprise identity source is needed, configure LDAP and confirm the connection is available through the test function.

5. Runtime

Configure Runtime based on team language and operation scale:

• Prompt Language: default en, Chinese teams can set it to zh.
• Stream Maxlen: default 10000, controls the approximate maximum length retained when writing Webhook alerts to Redis Stream.

Next Steps

• Mock Data — Import sample data to confirm Case, Alert, Artifact, and basic workspace features.
• Alert Ingestion — Choose Splunk Webhook, Kibana Webhook, or ELK Index Action to write real alerts into ASP.
• Skills — Let Harness Agents use ASP capabilities through asp-cli.
• Restart & Operations — Learn service restarts, log inspection, and custom dependency handling.