AI Security Intelligence for Your Findings

Ask AURIX is the conversational security intelligence interface inside AURIX SHIELD. It helps users understand, investigate, and reason about security findings using the security context already available in their AURIX SHIELD workspace.

Instead of manually collecting information from scanner results, repositories, files, and findings, users can ask questions about the security issue they are investigating. The workflow is: Finding → Security Context → Ask AURIX → AI Analysis → Explanation

Open Ask AURIX

Use Ask AURIX from the authenticated AURIX SHIELD dashboard to investigate security findings and their available context. Ask AURIX is the conversational interface for AURIX AI. It provides an AI-powered way to interact with security information collected by AURIX SHIELD.

Depending on the request and available context, Ask AURIX can work with information such as:

• Security findings
• Severity
• Scanner engine
• Repository
• File
• Detection rule
• Evidence
• Finding status
• Verification information

The purpose is to help users understand actual security data rather than provide only generic cybersecurity explanations. AURIX AI is the intelligence layer. Ask AURIX is the user-facing conversational interface. The relationship is: AURIX AI → Ask AURIX → Security Context → AI Response

AURIX AI provides the reasoning and intelligence layer around available security information. Ask AURIX provides the interface through which users interact with that intelligence.

Finding-Aware Conversations

Ask AURIX can work with specific security findings. When a finding is available as context, Ask AURIX can use information such as:

• Finding identity
• Severity
• Scanner
• Repository
• File
• Rule ID
• Evidence
• Verification state

This allows a conversation to remain connected to the actual security issue being investigated. A user does not have to manually copy every piece of finding information into the conversation.

Website Security Context

Ask AURIX can work with Website Security findings. Depending on the available finding context, this can include:

• Target
• Finding
• Scanner
• Severity
• Evidence
• Status
• Verification information

This allows users to ask questions about issues discovered during website security scans. Ask AURIX can work with GitHub security findings. GitHub finding context can include:

• Repository
• File
• Scanner engine
• Finding
• Rule identifier
• Evidence
• Severity
• Verification state

This allows users to investigate repository security issues conversationally. GitHub security questions can be associated with repository-specific context. This is important because the same type of security issue can appear in multiple repositories while representing completely different findings.

Ask AURIX therefore uses the relevant repository context when retrieving GitHub security information.

File Context

For source-code findings, the affected file can be an important part of the security context. Ask AURIX can use file information associated with a finding when that information is available. This helps connect an explanation to the location where the security issue was detected.

Scanner Context

Ask AURIX can use scanner information associated with a finding. For example, a GitHub finding can identify an engine such as:

• CodeQL
• Gitleaks
• Trivy
• OSV-Scanner
• AURIX Custom

The scanner context helps explain what type of detection produced the finding. Ask AURIX retrieves relevant security context for the authenticated user's request. The available context can come from:

• Website Security findings
• GitHub Security findings

For GitHub findings, repository-specific finding information can be used to provide the relevant security context. The objective is to provide the AI with the actual security information associated with the user's investigation.

Authentication and Ownership

Security context is tied to the authenticated user's AURIX SHIELD workspace. Ask AURIX performs authenticated access and ownership checks when retrieving security information. This is particularly important for GitHub findings because repository security information must remain associated with the correct authorized user and repository.

Ask AURIX should not treat another user's security findings as part of the current user's context.

How Ask AURIX Works

The simplified workflow is: Question → Context Retrieval → AI Analysis → Response

Question

The user asks a security-related question.

Context Retrieval

AURIX SHIELD identifies relevant authorized security information.

AI Analysis

AURIX AI analyzes the question using the available security context.

Response

Ask AURIX presents the resulting explanation conversationally.

Ask AURIX for Finding Investigation

Ask AURIX is especially useful when investigating a specific finding. A typical workflow is: Finding → Ask AURIX → Understand → Investigate → Fix → Verify The finding provides the security context. Ask AURIX helps explain and investigate that context. Fix & Verify remains responsible for the actual verification workflow.

Ask AURIX and the Security Engine

The Security Engine detects security issues. Ask AURIX helps users understand those detected issues. The relationship is: Security Engine → Finding → Ask AURIX The Security Engine remains responsible for detection. Ask AURIX is the intelligence and explanation layer around the resulting security information.

Ask AURIX and Fix & Verify

Ask AURIX and Fix & Verify have different responsibilities. An AI response is not a verification result. A finding should only be considered verified through the appropriate security verification workflow.

Ask AURIX Does Not Automatically Fix Code

Ask AURIX is an analysis and explanation interface. Ask AURIX does not replace the AURIX SHIELD Security Engine. The Security Engine uses specialized security scanners to detect issues. Ask AURIX works with the resulting security information. The relationship is:

• Detect
• Explain
• Fix
• Verify
• Monitor

Ask AURIX primarily supports the Explain and investigation part of this lifecycle.

Ask AURIX and Verification

Ask AURIX can explain verification information when that information is available in the finding context. However, Ask AURIX does not itself establish that a vulnerability has been fixed. Verification is performed by the appropriate AURIX SHIELD verification workflow. For GitHub findings, verification depends on the original scanner engine.

For example:

• AURIX Custom → targeted verification
• Gitleaks → file-local verification
• OSV-Scanner → dependency/lockfile verification
• Trivy → filesystem verification
• CodeQL → repository-wide analysis

See the Fix & Verify documentation for the complete verification workflow. Website findings can provide context for conversational investigation.

A user can use available finding information to understand:

• What was detected
• Which scanner detected it
• Which target was affected
• What evidence was collected
• What severity was assigned
• What the current finding state is

The underlying finding remains the source of the security evidence. GitHub findings can provide richer repository-specific context. Depending on the finding, Ask AURIX can work with:

• Repository
• File
• Scanner
• Rule
• Evidence
• Severity
• Verification state

This makes Ask AURIX useful for source-code, secret, dependency, filesystem, and custom security findings. Ask AURIX can distinguish security context associated with different security environments. A finding can originate from:

• Website Security
• GitHub Security

This source information helps keep the conversation connected to the correct type of security target. AURIX SHIELD applies short-term request rate limiting to Ask AURIX usage. Rate limiting is separate from the account's available AI usage quota.

If a user makes another request too quickly, Ask AURIX can temporarily require the user to wait before making another request. A temporary rate-limit response does not mean that the account has exhausted its available AI quota.

Usage Quotas

AURIX SHIELD also applies account-level AI usage controls. A usage quota determines whether the account still has available Ask AURIX usage under its current plan and product configuration. This is different from short-term request rate limiting. The two concepts are:

Rate Limit

A temporary delay between requests.

Usage Quota

The account's available AI usage allowance.

Free and Pro

AURIX SHIELD currently provides different Ask AURIX access levels for Free and Pro. The exact usage limits are controlled by the current product configuration and pricing plan.

See the Pricing documentation for the current plan comparison.

What Ask AURIX Does Not Do

• Ask AURIX does not guarantee that a security finding is correct or complete.
• It does not replace the underlying security scanners.
• It does not automatically commit code changes.
• It does not automatically deploy fixes.
• It does not independently verify that a vulnerability has been fixed.
• It does not provide access to security information that the authenticated user is not authorized to access.

An AI explanation should therefore be treated as an intelligence and investigation aid, while the underlying scanner results and verification workflows remain important technical evidence. Ask AURIX operates within the user's authenticated AURIX SHIELD context. Security information retrieval is subject to authentication and ownership checks.

This helps ensure that:

• Website findings remain within the authorized workspace.
• GitHub findings remain associated with the authorized user.
• Repository context is not mixed between unauthorized users.
• Finding-specific context is retrieved for the appropriate security target.

Ask AURIX Terminology

AURIX AI

The AI-powered security intelligence layer inside AURIX SHIELD.

Ask AURIX

The conversational interface for interacting with AURIX AI.

Security Context

The structured security information available to the AI for a request.

Finding Context

Information associated with a specific security finding, such as scanner, repository, file, severity, evidence, and verification state.

Rate Limit

A short-term control that can require a user to wait between requests.

Usage Quota

The account-level allowance controlling available AI usage.

Finding Investigation

The process of using security context to understand and analyze a detected issue.

Frequently Asked Questions

Explore AURIX SHIELD

• Product Documentation
• Security Engine
• AURIX AI
• GitHub Security
• Pricing
• Scan
• Monitor
• Fix