SARA Open — Settings

Sign in required

You need to sign in with Google to access settings.

Go back to SARA

Profile

Manage your display name and profile information.

What should SARA call you?

This is how SARA will address you in conversations.

Linked to your Google account. Cannot be changed here.

Response Language

SARA will respond in this language. Technical terms (CVEs, MITRE IDs, tool names) stay in English.

AI Model

Choose which AI model powers SARA's responses.

Bring Your Own Model

Choose any LLM provider. SARA works with OpenAI, Claude, Gemini, Mistral, Groq, Ollama, or any OpenAI-compatible endpoint.

Provider

OmniSense Integration

Connect your SIRP OmniSense tenant to query live incidents, run agents, and execute response actions.

Prerequisites

1. A SIRP OmniSense tenant (e.g., https://your-company.sirp.io)

2. Pro or Team plan on SARA Open

3. Either an API key or email + password (or both)

API key only: Recommended. Stateless, no session conflicts. Supports all features except multi-tenant switching.
Email + password: Enables multi-tenant switching and JWT-based features. May conflict with browser sessions.
Both: Best of both worlds. API key for data, credentials for admin features.

What You Can Do

Query incidents, alerts, cases	API key or credentials
View assets and risk scores	API key or credentials
Run agents (enrichment, analysis, triage)	API key or credentials
Execute actions (block IP, contain host)	API key required
Multi-tenant switching (MSSP)	Credentials required
Threat advisory feed ingestion	API key or credentials

Tenant URL *

Your SIRP OmniSense instance URL (must be HTTPS)

API Key (recommended)

To get your API key: OmniSense → Profile (bottom-left) → Profile Settings → API Key → Generate API Token

— or —

SIRP Email (optional if API key provided)

SIRP Password (optional if API key provided)

Stored encrypted. Used for JWT authentication and multi-tenant switching.

What you can do with OmniSense connected

"What's happening on my tenant?" -- live incident overview
"Show me my P1 incidents" -- filtered incident lists
"Analyze incident 263632" -- full case analysis with artifacts
"Enrich incident 263632" -- run OmniSense enrichment agents
"Show me my assets" -- asset risk overview by S3 score

More integrations coming soon

Privacy & Data

Your data, your control. SARA stores conversations to provide chat history — you can delete them anytime.

How Your Data Is Used

✓ Conversations — stored to provide chat history. You can delete individual chats from the sidebar or all history below.

✓ Credentials — OmniSense and LLM API keys are encrypted at rest (Fernet). Never stored in plaintext.

✓ IOC queries — IOCs you submit are enriched and stored for your reference in the observable database.

✗ Not used for training — your conversations are never used to train or fine-tune AI models.

✗ Not shared — your data is not shared with third parties. LLM providers process queries but do not retain them.

Delete All Conversations

Permanently delete all your saved conversations from both your browser and the server. This cannot be undone.

Delete Account

Remove your account and all associated data permanently — conversations, settings, API keys, integrations.

Billing & Plans

Upgrade your plan to unlock more messages, full enrichment, and OmniSense connectivity.

Monthly

Yearly Save ~17%

Your Plan

Current usage and rate limits for your account.

Queries this hour - / -

Used this hour

Remaining

Hourly limit

Message Breakdown

Total messages sent across all sessions.

Total messages

Today

API Access

Programmatic access to SARA's intelligence. Use API keys to integrate with your SOAR, SIEM, or custom tools. View full API documentation →

Your API Keys

Quick Start

All endpoints require the x-api-key header.

POST /api/v1/chat/completions OpenAI Compatible

Drop-in replacement for OpenAI API. Works with any OpenAI SDK, LangChain, or SOAR integration.

curl -X POST https://sara-open.sirp.io/api/v1/chat/completions \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"sara","messages":[{"role":"user","content":"What is CVE-2024-3400?"}]}'

Response format (OpenAI)

{
  "id": "chatcmpl-abc123",
  "object": "chat.completion",
  "model": "sara",
  "choices": [{"index":0,"message":{"role":"assistant","content":"..."},"finish_reason":"stop"}],
  "usage": {"prompt_tokens":150,"completion_tokens":200,"total_tokens":350}
}

Python SDK example

from openai import OpenAI
client = OpenAI(base_url="https://sara-open.sirp.io/api/v1", api_key="YOUR_KEY")
r = client.chat.completions.create(model="sara", messages=[{"role":"user","content":"..."}])
print(r.choices[0].message.content)

POST /api/v1/chat SARA Native

SARA's native format with mode, sources, and detected IOCs.

curl -X POST https://sara-open.sirp.io/api/v1/chat \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message": "What is CVE-2024-3400?"}'

Response format

{
  "response": "CVE-2024-3400 is a critical...",
  "mode": "threat_intel",
  "sources": ["Knowledge Base", "NVD"],
  "iocs_detected": [],
  "remaining_this_hour": 499,
  "hourly_limit": 500
}

POST /api/v1/enrich

IOC enrichment — up to 20 IOCs per request.

curl -X POST https://sara-open.sirp.io/api/v1/enrich \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"iocs": [{"value": "8.8.8.8", "type": "ip"}]}'

POST /api/v1/analyze

Alert, email, or CVE analysis. Types: alert, email, cve, auto.

curl -X POST https://sara-open.sirp.io/api/v1/analyze \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content": "EventID=4625 ...", "type": "alert"}'

Rate Limits: Pro: 200 req/hr (3 keys) | Team: 500 req/hr (10 keys)
Auth: x-api-key: sara_... header on every request
Multi-turn: Use {"messages": [...]} for conversation context

Connectors

Create custom webhook actions and connect external AI agents. Connectors start in dry-run mode for safety.

New Connector

Configure your connector's endpoint, triggers, and authentication.

Basics

Connector Type

Webhook: calls an HTTP endpoint. A2A Agent: routes queries to an external AI agent.

Name *

Description

Connection

Endpoint URL *

HTTP Method

Auth Type

Timeout (sec)

Triggers & Target

Trigger Phrases *

Comma-separated phrases that activate this plugin in chat.

Capability

Target Type

Body Template (JSON)

Use {target}, {reason}, {user} as variables. They'll be substituted at execution time.

SARA's Tools

These are the tools SARA can use during investigations. Tools are selected automatically based on your query, plan, and tenant connection.

Coming Soon: Create Custom Tools

SARA will be able to create new tools at runtime using OmniSense APIs. When SARA encounters a gap in her capabilities, she'll generate a tool on the fly, execute it, and offer to save it as a permanent custom tool.

SIRP Instance Connection

Connect SARA to your SIRP instance via SSH. SARA can run diagnostic commands, test integration connectivity, and troubleshoot issues directly on your SIRP server.

SIRP Instance SSH

Security Notice

SSH credentials are encrypted at rest. SARA classifies commands into three tiers: READ (auto-allowed: ls, ps, cat, curl GET), WRITE (requires approval: restart, config edits), DANGEROUS (blocked: rm -rf, shutdown, chmod 777). All commands are logged in an audit trail.

Investigation Skills

Skills are reasoning presets that customize how SARA investigates. Select a skill in the chat header to activate it.

Bundled Skills

Your Custom Skills

SARA's Memory

SARA remembers your preferences, corrections, and investigation patterns to personalize responses. You can view, add, or delete memories.

Sign in required

Profile

AI Model

OmniSense Integration

What you can do with OmniSense connected

Privacy & Data

Delete All Conversations

Delete Account

Billing & Plans

Current Subscription

Your Plan

Message Breakdown

API Access

Your API Keys

Quick Start

Connectors

New Connector

SARA's Tools

Coming Soon: Create Custom Tools

SIRP Instance Connection

SIRP Instance SSH

Security Notice

Investigation Skills

Bundled Skills

Your Custom Skills

Create Skill

SARA's Memory

Add a Memory

Stored Memories (0)

Delete all history?