Skip to main content

Reading answers

Vesper's answers are deliberately structured and deliberately sourced. This page explains how to read one critically.

The four sections​

Every generated answer uses the same format:

  • Summary. The question restated, so you can spot immediately if Vesper misunderstood you and rephrase.
  • Diagnosis. What the retrieved threads suggest is happening in your situation.
  • Steps. Numbered actions, in order. These are synthesized from what actually resolved the matching community threads.
  • Verification. How to check the steps worked, so the answer closes the loop instead of leaving you guessing.

The sources panel​

Each answer lists the community threads it was grounded in. A source line carries the thread identifier, the channel it came from, and a similarity score:

slack_C0A933R8E_1770345081.877019 | community       | similarity=0.6003
discord_1485989415120666624       | community       | similarity=0.5384
slack_C07CNG3M11N_1769281302      | wazuh-dashboard | similarity=0.5705

Similarity is the vector-space closeness between your question and the thread, between 0 and 1. Use it as a confidence signal:

  • Scores around 0.6 and above usually mean the corpus contains threads about your exact problem.
  • A pile of scores below ~0.4 means Vesper is working from loosely related material; treat the steps as leads, not a procedure.

When the corpus has no good match​

Vesper is instructed to be honest about weak grounding. If the retrieved threads do not actually cover your question, the Diagnosis will say there is insufficient evidence in the context, and the Steps will point you at research directions (documentation, community channels, threat intel sources) rather than inventing a procedure.

If that happens, try:

  • Rephrasing with Wazuh vocabulary. Name the component (manager, agent, indexer, dashboard) and the module; the corpus is indexed on how the community actually writes.
  • Splitting compound questions. One failure mode per question retrieves much better than a paragraph with three problems in it.
  • Asking the agent instead. If the question is about your deployment ("why is my agent 003 disconnected?"), the agent can look at the environment directly instead of reasoning from the corpus.