Ask AI
Ask AI answers questions about your firewalls in plain language. It selects the queries to run, runs them, and answers from the results.
It runs as your own SIP user, so Security Manager applies the same permissions it would in its own UI, and it answers for the selected device group. Everything it does is read-only. Nothing it can call changes a rule, a ticket or a setting.
What it can answer
| Ask about | What it reaches |
|---|---|
| Firewall rules | Counts and searches by source, destination, port or service, and allow or deny; every rule on a named device. The literal PUBLIC_INTERNET stands in for traffic from or to the internet. |
| Devices and device groups | Which groups exist and which devices are in one, plus the KPIs Security Manager keeps per device and per group — control failures by severity, security concern index, configuration changes, complexity. |
| Network paths | Whether a packet gets from one address to another on a given TCP port, by simulating the path hop by hop. |
| Metrics | Current values for a group or a device, the trend for one metric over a period, and a summary across a date range. Metrics covers what they count. |
| Compliance and assessments | FireMon Best Practices Assessment results, including how per-control failures have moved between periods. |
| Policy Planner | Your workflows, the stages each one runs, and the tickets themselves. Needs a Policy Planner license. See Policy Planner. |
| Product documentation | FireMon product documentation, returned with links to the pages it drew from, and where a given screen lives in the SIP UI. |
Anything those searches do not cover, it reaches through SIQL, FireMon's query language: network and service objects, NAT rules, policies, assets and tickets. A second model writes the query, so asking does not require SIQL.
It can also export an answer as CSV. Exports re-run the queries on the server and cover the whole result set rather than what was displayed, up to a row limit it tells you about.
Where to find it
Ask Policy Manager AI opens the assistant over whatever page you are on. Best Practices offers Ask AI about this data, which opens the same assistant already pointed at your assessment results. It is also reachable directly at /chatbot, though nothing in Insights links there.
How current an answer is
Ask AI reads from two places, depending on the question.
| Asked about | Answered from |
|---|---|
| Rules, objects, NAT rules, policies, assets | Your SIP, as it stands now |
| Whether traffic gets from A to B | Your SIP, as it stands now |
| Device and device group listings | Your SIP, as it stands now |
| The KPIs Security Manager computes per device and per group | Your SIP, as it stands now |
| Policy Planner workflows and tickets | Your SIP, as it stands now |
| Metric values, trends and summaries | The copy Insights collected — up to 24 hours old |
| Best Practices control results | The copy Insights collected — up to 24 hours old |
So "do any rules allow SSH from the internet?" is answered from your rules as they stand now. "How many unused rules do I have?" reports what your SIP last sent. How Insights gets your data covers the collection, and what the stored copy holds.
Both routes travel the same connection from FireMon's cloud to your installation, and both are refused for a device group your SIP user is not authorized for. Device groups covers that scoping.
Choosing a model
Two model providers are available, OpenAI and Claude. Switching between them clears the conversation, since context does not carry across providers.
Your organization can be locked to one provider, and that lock is set for the whole organization rather than in Insights. Where an organization runs on its own AI keys and has none stored for the provider it is allowed to use, Ask AI cannot accept a question at all, and reports that setup is incomplete.
When it is unavailable
Your organization has turned it off. This is an account-level setting, not one Insights exposes.
Your SIP is not connected. Anything needing a live query is unanswerable until the connection returns. Use Demo Data points the assistant at FireMon's demo environment instead, so the answers are not about your own devices. It turns off when your SIP reconnects.
What to expect of an answer
Models get answers wrong, and the same question asked twice can return different results. Verify anything you plan to act on. Every reply can show the queries behind it, and a SIQL query opens in Security Manager, which returns every result rather than the subset that fits in an answer.
Long conversations are trimmed. The history sent with each question is capped, so in a long session the earliest exchanges drop off and a large result set can be cut to fit. A fresh conversation starts with the full allowance.
Insights stores your conversations against your account, along with the results of the queries run to produce them. Local transcripts left untouched for 30 days are cleared. See How Insights gets your data.
Using your own AI client
Everything above is FireMon's model working over your data. The same tools are available over MCP to your own model, against the same data and the same permissions. See MCP Server.