[8.8] [Security Solution] Elastic Security Assistant (#156933) #158974
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## [Security Solution] Elastic Security Assistant The _Elastic Security Assistant_ has entered the chat, integrating generative AI and large language models (LLMs) into the workflows of Elastic Security users. Bring your alerts, events, rules, and data quality checks into the conversation. <https://github.com/elastic/kibana/assets/2946766/31d65c78-5692-4817-b726-820c5df0801c> This PR merges a feature branch developed by @spong and @andrew-goldstein , seeded by @jamesspi 's prototype of the assistant. Connectivity to LLMs is provided the [Generative AI Connector](<elastic#157228>) , developed by @stephmilovic . This PR includes: - A new reusable Kibana package containing the assistant: `x-pack/packages/kbn-elastic-assistant` - See the `How to embed the Assistant in other parts of Kibana` for details - Assistant integration into Elastic Security Solution workflows (e.g. alerts, cases, Timeline, rules, data quality) ### An assistant trained on the Elastic stack and Elastic Security The [Generative AI Connector](<elastic#157228>) connects the assistant to OpenAI and Azure OpenAI models trained with knowledge of the Elastic stack and the Elastic Security solution, including: - The Elastic open [Detection Rules](https://github.com/elastic/detection-rules) - The [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/index.html) - Elastic query languages, including [KQL](https://www.elastic.co/guide/en/kibana/current/kuery-query.html), [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html), and the [Elastic Query DSL](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html) - [Elasticsearch API documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/rest-apis.html) This training enables the assistant to offer fully interactive chat experiences that include: - alert summarization - interactive query generation - workflow suggestions - generating ingestion configurations that conform to the Elastic Common Schema - your imagination using context from Elastic Security. ### Take action from your conversations The Actions (from assistant response): - Send KQL to Timeline - Send EQL to Timeline - Send Elasticsearch DSL to Timeline - Send Note to timeline - Create new case - Add to existing case - Copy to clipboard ### Components architecture diagram  ### How to embed the Assistant in other parts of Kibana Follow the general instructions in `x-pack/packages/kbn-elastic-assistant/index.ts` to integrate the assistant into a Kibana app. #### Step 1 - Wrap your Kibana app in the `AssistantProvider` component ```ts // Step 1: Wrap your Kibana app in the `AssistantProvider` component. This typically // happens in the root of your app. Optionally provide a custom title for the assistant: /** provides context (from the app) to the assistant, and injects Kibana services, like `http` */ export { AssistantProvider } from './impl/assistant_context'; ``` #### Step 2: Add the `AssistantOverlay` component to your app ```ts // Step 2: Add the `AssistantOverlay` component to your app. This component displays the assistant // overlay in a modal, bound to a shortcut key: /** modal overlay for Elastic Assistant conversations */ export { AssistantOverlay } from './impl/assistant/assistant_overlay'; // In addition to the `AssistantOverlay`, or as an alternative, you may use the `Assistant` component // to display the assistant without the modal overlay: /** this component renders the Assistant without the modal overlay to, for example, render it in a Timeline tab */ export { Assistant } from './impl/assistant'; ``` #### Step 3: Wherever you want to bring context into the assistant, use the any combination of the following ```ts // Step 3: Wherever you want to bring context into the assistant, use the any combination of the following // components and hooks: // - `NewChat` component // - `NewChatById` component // - `useAssistantOverlay` hook /** * `NewChat` displays a _New chat_ icon button, providing all the context * necessary to start a new chat. You may optionally style the button icon, * or override the default _New chat_ text with custom content, like `🪄✨` * * USE THIS WHEN: All the data necessary to start a new chat is available * in the same part of the React tree as the _New chat_ button. */ export { NewChat } from './impl/new_chat'; /** * `NewChatByID` displays a _New chat_ icon button by providing only the `promptContextId` * of a context that was (already) registered by the `useAssistantOverlay` hook. You may * optionally style the button icon, or override the default _New chat_ text with custom * content, like {'🪄✨'} * * USE THIS WHEN: all the data necessary to start a new chat is NOT available * in the same part of the React tree as the _New chat_ button. When paired * with the `useAssistantOverlay` hook, this option enables context to be be * registered where the data is available, and then the _New chat_ button can be displayed * in another part of the tree. */ export { NewChatById } from './impl/new_chat_by_id'; /** * `useAssistantOverlay` is a hook that registers context with the assistant overlay, and * returns an optional `showAssistantOverlay` function to display the assistant overlay. * As an alterative to using the `showAssistantOverlay` returned from this hook, you may * use the `NewChatById` component and pass it the `promptContextId` returned by this hook. * * USE THIS WHEN: You want to register context in one part of the tree, and then show * a _New chat_ button in another part of the tree without passing around the data, or when * you want to build a custom `New chat` button with features not not provided by the * `NewChat` component. */ export { useAssistantOverlay } from './impl/assistant/use_assistant_overlay'; ``` Co-authored-by: Garrett Spong <[email protected]> Co-authored-by: Andrew Macri <[email protected]> (cherry picked from commit 4e38817) # Conflicts: # .github/CODEOWNERS # x-pack/plugins/security_solution/public/common/components/event_details/translations.ts # x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx
💚 Build Succeeded
Metrics [docs]Module Count
Public APIs missing comments
Any counts in public APIs
Async chunks
Public APIs missing exports
Page load bundle
Unknown metric groupsAPI count
ESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto8.8:Questions ?
Please refer to the Backport tool documentation