AI in Attic MDR: Frequently Asked Questions
Our MDR service uses an LLM to accelerate analyst triage. Because we monitor Microsoft environments and the LLM also runs on Microsoft Azure, your data stays inside the same processor chain you already have for Defender and Sentinel.
Where does the AI run?
In Microsoft Azure AI Foundry, Sweden Central. EU region, EU data protection law, covered by Microsoft's EU Data Boundary commitments. We do not route data outside the EU.
Which model?
The Anthropic Claude family, hosted natively in Azure. When Claude runs in Foundry, Anthropic does not see your data. Microsoft serves the model from its own infrastructure under its own data handling rules. We might add models in the future, those will also be hosted in Azure.
Is our data used to train models?
No. Calls are stateless. Your prompts and outputs are not used to train any model, ours or Microsoft's or Anthropic's. This is one of the reasons we chose Foundry over direct provider APIs.
Who can access the data?
The same processor chain as the rest of your Microsoft environment:
- You (controller)
- Attic (processor, monitoring your tenant)
- Microsoft (sub-processor, running Foundry)
What is sent to the LLM?
Alert metadata, entity context (machines, users, IPs, hashes, command lines), and the tenant context needed to apply the right runbook.
We do not send email bodies, file contents, or documents.
Is the LLM making decisions on its own?
No. The LLM proposes a classification and reasoning; it can suggest actions but not execute them. We removed runtime auto-escalation specifically so high-impact decisions stay with humans.