[Security Solution] Elastic Security Assistant

.eslintrc.js

@@ -982,6 +982,7 @@ module.exports = {
       // front end and common typescript and javascript files only
       files: [
         'x-pack/plugins/ecs_data_quality_dashboard/common/**/*.{js,mjs,ts,tsx}',
+        'x-pack/packages/kbn-elastic-assistant/**/*.{js,mjs,ts,tsx}',
         'x-pack/packages/security-solution/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/security_solution/public/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/security_solution/common/**/*.{js,mjs,ts,tsx}',
@@ -1009,13 +1010,15 @@ module.exports = {
       // This should be a very small set as most linter rules are useful for tests as well.
       files: [
         'x-pack/plugins/ecs_data_quality_dashboard/**/*.{ts,tsx}',
+        'x-pack/packages/kbn-elastic-assistant/**/*.{ts,tsx}',
         'x-pack/packages/security-solution/**/*.{ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{ts,tsx}',
         'x-pack/plugins/cases/**/*.{ts,tsx}',
       ],
       excludedFiles: [
         'x-pack/plugins/ecs_data_quality_dashboard/**/*.{test,mock,test_helper}.{ts,tsx}',
+        'x-pack/packages/kbn-elastic-assistant/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/packages/security-solution/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{test,mock,test_helper}.{ts,tsx}',
@@ -1029,6 +1032,7 @@ module.exports = {
       // typescript only for front and back end
       files: [
         'x-pack/plugins/ecs_data_quality_dashboard/**/*.{ts,tsx}',
+        'x-pack/packages/kbn-elastic-assistant/**/*.{ts,tsx}',
         'x-pack/packages/security-solution/**/*.{ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{ts,tsx}',
@@ -1061,6 +1065,7 @@ module.exports = {
       // typescript and javascript for front and back end
       files: [
         'x-pack/plugins/ecs_data_quality_dashboard/**/*.{js,mjs,ts,tsx}',
+        'x-pack/packages/kbn-elastic-assistant/**/*.{js,mjs,ts,tsx}',
         'x-pack/packages/security-solution/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/security_solution/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/timelines/**/*.{js,mjs,ts,tsx}',

.github/CODEOWNERS

@@ -321,6 +321,7 @@ packages/kbn-ebt-tools @elastic/kibana-core
 packages/kbn-ecs @elastic/kibana-core @elastic/security-threat-hunting-investigations
 x-pack/packages/security-solution/ecs_data_quality_dashboard @elastic/security-threat-hunting-investigations
 x-pack/plugins/ecs_data_quality_dashboard @elastic/security-threat-hunting-investigations
+x-pack/packages/kbn-elastic-assistant @elastic/security-solution
 test/plugin_functional/plugins/elasticsearch_client_plugin @elastic/kibana-core
 x-pack/test/plugin_api_integration/plugins/elasticsearch_client @elastic/kibana-core
 x-pack/plugins/embeddable_enhanced @elastic/kibana-presentation

package.json

@@ -361,6 +361,7 @@
     "@kbn/ecs": "link:packages/kbn-ecs",
     "@kbn/ecs-data-quality-dashboard": "link:x-pack/packages/security-solution/ecs_data_quality_dashboard",
     "@kbn/ecs-data-quality-dashboard-plugin": "link:x-pack/plugins/ecs_data_quality_dashboard",
+    "@kbn/elastic-assistant": "link:x-pack/packages/kbn-elastic-assistant",
     "@kbn/elasticsearch-client-plugin": "link:test/plugin_functional/plugins/elasticsearch_client_plugin",
     "@kbn/elasticsearch-client-xpack-plugin": "link:x-pack/test/plugin_api_integration/plugins/elasticsearch_client",
     "@kbn/embeddable-enhanced-plugin": "link:x-pack/plugins/embeddable_enhanced",

packages/kbn-babel-preset/styled_components_files.js

@@ -16,6 +16,7 @@ module.exports = {
     /src[\/\\]plugins[\/\\](kibana_react)[\/\\]/,
     /x-pack[\/\\]plugins[\/\\](apm|beats_management|cases|fleet|infra|lists|observability|observability_shared|exploratory_view|osquery|security_solution|timelines|synthetics|ux)[\/\\]/,
     /x-pack[\/\\]test[\/\\]plugin_functional[\/\\]plugins[\/\\]resolver_test[\/\\]/,
+    /x-pack[\/\\]packages[\/\\]elastic_assistant[\/\\]/,
     /x-pack[\/\\]packages[\/\\]security-solution[\/\\]ecs_data_quality_dashboard[\/\\]/,
   ],
 };

tsconfig.base.json

@@ -636,6 +636,8 @@
       "@kbn/ecs-data-quality-dashboard/*": ["x-pack/packages/security-solution/ecs_data_quality_dashboard/*"],
       "@kbn/ecs-data-quality-dashboard-plugin": ["x-pack/plugins/ecs_data_quality_dashboard"],
       "@kbn/ecs-data-quality-dashboard-plugin/*": ["x-pack/plugins/ecs_data_quality_dashboard/*"],
+      "@kbn/elastic-assistant": ["x-pack/packages/kbn-elastic-assistant"],
+      "@kbn/elastic-assistant/*": ["x-pack/packages/kbn-elastic-assistant/*"],
       "@kbn/elasticsearch-client-plugin": ["test/plugin_functional/plugins/elasticsearch_client_plugin"],
       "@kbn/elasticsearch-client-plugin/*": ["test/plugin_functional/plugins/elasticsearch_client_plugin/*"],
       "@kbn/elasticsearch-client-xpack-plugin": ["x-pack/test/plugin_api_integration/plugins/elasticsearch_client"],

x-pack/.i18nrc.json

@@ -21,6 +21,7 @@
     "xpack.dashboard": "plugins/dashboard_enhanced",
     "xpack.discover": "plugins/discover_enhanced",
     "xpack.crossClusterReplication": "plugins/cross_cluster_replication",
+    "xpack.elasticAssistant": "packages/kbn-elastic-assistant",
     "xpack.embeddableEnhanced": "plugins/embeddable_enhanced",
     "xpack.endpoint": "plugins/endpoint",
     "xpack.enterpriseSearch": "plugins/enterprise_search",

x-pack/packages/kbn-elastic-assistant/README.md

@@ -0,0 +1,20 @@
+# @kbn/elastic-assistant
+
+The `Elastic Assistant` is a user interface for interacting with generative AIs, like `ChatGPT`.
+
+This package provides:
+
+- Components for rendering the `Elastic Assistant`
+- Hooks for passing context (for example, fields in an alert) to the `Elastic Assistant`, enabling users to include this content in their queries
+
+## Maintainers
+
+Maintained by the Security Solution team
+
+## Running unit tests with code coverage
+
+To (interactively) run unit tests with code coverage, run the following command:
+
+```sh
+cd $KIBANA_HOME && node scripts/jest --watch x-pack/packages/kbn-elastic-assistant --coverage
+```

x-pack/packages/kbn-elastic-assistant/impl/assistant/api.tsx

@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { OpenAiProviderType } from '@kbn/stack-connectors-plugin/public/common';
+
+import { HttpSetup } from '@kbn/core-http-browser';
+import type { Message } from '../assistant_context/types';
+import { Conversation } from '../assistant_context/types';
+import { API_ERROR } from './translations';
+
+export interface FetchConnectorExecuteAction {
+  apiConfig: Conversation['apiConfig'];
+  http: HttpSetup;
+  messages: Message[];
+  signal?: AbortSignal | undefined;
+}
+
+export const fetchConnectorExecuteAction = async ({
+  http,
+  messages,
+  apiConfig,
+  signal,
+}: FetchConnectorExecuteAction): Promise<string> => {
+  const outboundMessages = messages.map((msg) => ({
+    role: msg.role,
+    content: msg.content,
+  }));
+
+  const body =
+    apiConfig?.provider === OpenAiProviderType.OpenAi
+      ? {
+          model: 'gpt-3.5-turbo',
+          messages: outboundMessages,
+          n: 1,
+          stop: null,
+          temperature: 0.2,
+        }
+      : {
+          messages: outboundMessages,
+        };
+
+  const requestBody = {
+    params: {
+      subActionParams: {
+        body: JSON.stringify(body),
+      },
+      subAction: 'test',
+    },
+  };
+
+  try {
+    // TODO: Find return type for this API
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const response = await http.fetch<any>(
+      `/api/actions/connector/${apiConfig?.connectorId}/_execute`,
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(requestBody),
+        signal,
+      }
+    );
+
+    const data = response.data;
+    if (response.status !== 'ok') {
+      return API_ERROR;
+    }
+
+    if (data.choices && data.choices.length > 0 && data.choices[0].message.content) {
+      const result = data.choices[0].message.content.trim();
+      return result;
+    } else {
+      return API_ERROR;
+    }
+  } catch (error) {
+    return API_ERROR;
+  }
+};

x-pack/packages/kbn-elastic-assistant/impl/assistant/assistant_overlay/index.tsx

@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useEffect, useState } from 'react';
+import { EuiModal } from '@elastic/eui';
+
+import useEvent from 'react-use/lib/useEvent';
+// eslint-disable-next-line @kbn/eslint/module_migration
+import styled from 'styled-components';
+import { ShowAssistantOverlayProps, useAssistantContext } from '../../assistant_context';
+import { Assistant } from '..';
+import { WELCOME_CONVERSATION_TITLE } from '../use_conversation/translations';
+
+const isMac = navigator.platform.toLowerCase().indexOf('mac') >= 0;
+
+const StyledEuiModal = styled(EuiModal)`
+  min-width: 1200px;
+  max-height: 100%;
+  height: 100%;
+`;
+
+/**
+ * Modal container for Security Assistant conversations, receiving the page contents as context, plus whatever
+ * component currently has focus and any specific context it may provide through the SAssInterface.
+ */
+export const AssistantOverlay: React.FC = React.memo(() => {
+  const [isModalVisible, setIsModalVisible] = useState(false);
+  const [conversationId, setConversationId] = useState<string | undefined>(
+    WELCOME_CONVERSATION_TITLE
+  );
+  const [promptContextId, setPromptContextId] = useState<string | undefined>();
+  const { setShowAssistantOverlay } = useAssistantContext();
+
+  // Bind `showAssistantOverlay` in SecurityAssistantContext to this modal instance
+  const showOverlay = useCallback(
+    () =>
+      ({
+        showOverlay: so,
+        promptContextId: pid,
+        conversationId: cid,
+      }: ShowAssistantOverlayProps) => {
+        setIsModalVisible(so);
+        setPromptContextId(pid);
+        setConversationId(cid);
+      },
+    [setIsModalVisible]
+  );
+  useEffect(() => {
+    setShowAssistantOverlay(showOverlay);
+  }, [setShowAssistantOverlay, showOverlay]);
+
+  // Register keyboard listener to show the modal when cmd + ; is pressed
+  const onKeyDown = useCallback(
+    (event: KeyboardEvent) => {
+      if (event.key === ';' && (isMac ? event.metaKey : event.ctrlKey)) {
+        event.preventDefault();
+        setIsModalVisible(!isModalVisible);
+      }
+    },
+    [isModalVisible]
+  );
+  useEvent('keydown', onKeyDown);
+
+  // Modal control functions
+  const cleanupAndCloseModal = useCallback(() => {
+    setIsModalVisible(false);
+    setPromptContextId(undefined);
+    setConversationId(conversationId);
+  }, [conversationId]);
+
+  const handleCloseModal = useCallback(() => {
+    cleanupAndCloseModal();
+  }, [cleanupAndCloseModal]);
+
+  return (
+    <>
+      {isModalVisible && (
+        <StyledEuiModal onClose={handleCloseModal}>
+          <Assistant conversationId={conversationId} promptContextId={promptContextId} />
+        </StyledEuiModal>
+      )}
+    </>
+  );
+});
+
+AssistantOverlay.displayName = 'AssistantOverlay';

x-pack/packages/kbn-elastic-assistant/impl/assistant/assistant_overlay/translations.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const CANCEL_BUTTON = i18n.translate(
+  'xpack.elasticAssistant.assistant.overlay.CancelButton',
+  {
+    defaultMessage: 'Cancel',
+  }
+);