Skip to main content
The LARK includes AI assistance that runs entirely on the appliance. By default this is available through OpenWebUI. When the optional case-work application is installed, it adds structured investigation tracking and automation.

​
OpenWebUI (default)

OpenWebUI is the interface for the appliance’s local AI. Through it, analysts query the local models, review findings, and obtain assistance with investigative work, from a web browser. Behind the interface, model inference runs on the appliance itself using its local inference engine, vLLM. All models, data, and interactions remain on the appliance, so OpenWebUI operates fully in isolated or air-gapped environments with no external connectivity required.
The product documentation can be loaded into the local knowledge base, allowing questions about the appliance and its tools to be answered directly through OpenWebUI.
OpenWebUI is reached from the home page as any other application. The system access page covers reaching it and signing in.

​
Case work (optional)

The case-work capability described below is provided by an optional application and may not be installed on a given appliance. The optional software page provides details.
When the optional case-work application is installed, it serves as the system of record for investigations. A case holds the durable record of an investigation, including its ownership, priority, status, comments, evidence, tasks, and related activity, allowing analysts to work from a single timeline rather than treating each automated run as a separate artifact. It also includes an AI assistant within the case view. Rather than switching to a separate tool, analysts can direct the assistant to summarize activity, answer questions, and draft next steps from the case timeline, its linked evidence, and any workflow output.
Analyst review is required before any action is taken or any report content is finalized. The AI assists the analyst; it does not replace review.

​
Creating agents

The case-work application supports AI agents for repeatable, tool-calling tasks, allowing common investigative work to be standardized rather than driven by ad hoc prompts. Typical examples include triage, summarization, enrichment, and reporting agents. An agent is created by opening the case-work application, navigating to its agents area, and starting a new agent. In the agent builder:
1

Define the purpose

State the agent’s purpose in one sentence, for example, “Summarize case evidence and recommend next actions.”
2

Write clear operating instructions

Keep instructions narrow and operational. For example: summarize only from case content and attached evidence, do not speculate, do not expose secrets, and return findings in a fixed structure.
3

Limit the agent's actions

Grant the agent only the tools, integrations, and actions it requires. This is the primary control for keeping an agent focused and preventing unnecessary tool use.
4

Set execution limits

Bound the work an agent performs in a single run by capping the number of tool calls and requests. This keeps the agent predictable.
5

Use structured outputs

Where possible, configure the agent to return a structured result, such as an incident summary, recommended actions, an evidence checklist, or an escalation recommendation.
6

Save reusable agents

Where the same logic will be reused, save it as a preset agent.