---
title: "Giving Halon a file"
description: "Attach a screenshot, a PDF or a log to a question and Halon reads it as evidence."
canonical: https://firefight.app/docs/ai/files
---

# Giving Halon a file

Halon reads the files you send with a question. Attach a screenshot of a graph, a PDF runbook or a log, and Halon answers from what is in it, naming the file it relied on.

## In the dashboard

Open **Chat** under Halon in the sidebar. There are three ways to add a file to the message you are writing.

- Choose **+**, then **Attach files**, and pick one or more files
- Drag files onto the message box
- Paste a screenshot into the message box

Each file appears above the message as a chip with its name and size, and starts uploading straight away. A picture shows a small preview. Choose the cross on a chip to take the file off before you send. A message can be files alone, with nothing typed.

Once sent, the files sit on your message in the chat. Images show inline, and choosing one opens it at full size. Any other file shows as a chip you can choose to download.

When you ask Halon in a chat to start an investigation, the run reads every file sent in that chat too.

## In Slack

Mention @Firefight in an incident channel or one of its threads, or write to Firefight in your direct messages, and attach the files to the same message. Halon reads them with your question, and a message with files and no words counts as a question. A file Firefight could not download, or one Halon does not read, is named in the answer with the reason.

The same goes for a mention that starts an [investigation](https://firefight.app/docs/ai/investigations.md), such as `@Firefight investigate checkout is failing` with a log attached, and for a mention in the thread of a run that is still working. The run reads the files with what you wrote, and its story in the dashboard names each file, with **Not read** on any it could not read and the reason when you point at it. Choose an image there to see it full size, or any other file to download it. Files alone in a running investigation's thread count as something added to the run.

## What Halon reads

| File | Accepted | Largest file |
|---|---|---|
| Images | PNG, JPEG, GIF, WebP | 5 MB |
| PDFs | Any PDF that is not password protected | 10 MB |
| Text | Logs, plain text, CSV, JSON, YAML, Markdown, and source code | 5 MB |

Up to four files go with one message. Anything else is refused with a message saying what is accepted. Some AI providers take smaller images and PDFs, and the message box tells you the limit when a file is over it. What a file is comes from its contents rather than its name, so a renamed image is still read as an image, and a binary file named like text is refused.

A long text file is not cut off silently. Halon reads how it starts and ends, and searches the rest for what it needs. A PDF longer than 100 pages is read as the text of its first 100 pages.

Halon looks at images and PDFs again on every turn of a chat, up to the newest 20 files and 20 MB together. In a long chat with more than that, an older image is only named and an older PDF is read as its text, so attach an image again if Halon needs to look at it afresh.

## When the model cannot read a file

Which files Halon can look at depends on the AI model your workspace runs. When the model is not known to read images, the dashboard says so on the image's chip before you send, and Halon tells you it could not look at the image rather than guessing at it. Pasting the text from a screenshot works instead. A PDF is read as a document when the model takes PDFs, and as its text when it does not.

## Safety

- Anything that looks like a credential in a text file or a PDF's text is replaced before Halon reads it, using the same redaction as incident channels. A PDF that holds one is given to Halon as its redacted text, never as the original document. See [AI data handling](https://firefight.app/docs/ai/data-handling.md).
- Halon treats what a file says as evidence about the situation. An instruction written inside a file is never followed.
- Files are stored encrypted. Only you can open the files in your own chats, including the chats in your direct messages.

## How long files are kept

| Where the file was sent | Deleted when |
|---|---|
| Your chat in the dashboard, or in your direct messages | You delete the chat |
| An incident channel in Slack | The incident's conversation is deleted under your retention setting, see [Incident conversations](https://firefight.app/docs/workspace/incident-conversations.md) |
| An investigation of an incident | The incident's conversation is deleted under your retention setting |
| Attached but never sent | One day after it was attached |