Expand and refine docs for AI Assistant [8.9.0]

[joepeeples]

Description

The initial docs for AI Assistant's MVP release in 8.8.1 were intended to be somewhat minimal, focusing on making sure readers know how to set up the Assistant and use some basic functionality. For 8.9.0, expand the docs with further nuances, full functionality, best practices & guidance on writing effective prompts, known issues, troubleshooting, and so on.

Also include any new/refined features implemented by development since the 8.8.1 release.

Related (consider breaking features into separate issues/PRs?):

• https://github.com/elastic/security-team/issues/6877 (this also lists issues/PRs for other features in 8.9)
• [Security Solution] [Elastic AI Assistant] Data anonymization kibana#159857
• [Security solution] Implement dashboard to track Gen AI Token Usage kibana#159075

Background:

• Docs PR for 8.8.1: Elastic Security Assistant initial docs (8.8.1) #3425 (issue #3420)
• Dev:
  • Epic: https://github.com/elastic/security-team/issues/6775
  • Another Epic: https://github.com/elastic/security-team/issues/6475
  • Kibana PR: [Security Solution] Elastic Security Assistant kibana#156933
  • Another one: [Security Solution] Elastic Security Assistant fixes kibana#159054

To Do

Connector - @joepeeples

• Create stub page for docs link: creating a role with privileges needed to view/query data on token tracking dashboard
• Add docs for token dashboard, incl privileges needed to view the data (Kibana docs? also mention in Security docs?)

General updates - @joepeeples

• Rename from Security Assistant to AI Assistant
• Remove feature flag instructions
• Add blurb: we do not store or process user data (@jamesspi to provide draft)
• Update screenshot/GIF of initial chat

Anonymization - @benironside

• Remove data anonymization notes
• Add section on configuring anonymizations (if this gets too long, maybe consider breaking out to separate topic?)

Expand existing features - @benironside

• System prompts - additional configuration options (at start of conversation AND in prompt editor box)
• Quick prompts - more details on usage, create custom prompts, delete (hover to display red X)
• Action buttons - new: select AI model (OpenAI only) - to be merged soon (not in BC3)

[jamesspi]

@joepeeples , created this issue for the removal of the feature flag in 8.9. We would need to update the relevant parts of the docs too. https://github.com/elastic/security-team/issues/6877

[jamesspi]

Hi @joepeeples ,

There are screenshots for the role creation to give users read-only access for the event log (which powers the token tracking dashboard) in this comment - elastic/kibana#159075 (comment)

Would you need me to list out the steps, or are you able to derive them from the screenshots?

[joepeeples]

Would you need me to list out the steps, or are you able to derive them from the screenshots?

Thanks, @jamesspi! I think the screenshots are enough — I'll share once I have a draft so you can confirm if I covered everything.

[jamesspi]

@joepeeples , here's the blurb for the data processing (or lack of):

"Elastic does not store or examine prompts or results sent to or generated by the AI Assistant, nor is it used for any future training or context. This data is sent to and processed by the third party provider of choice when setting up the generative AI connector, as part of the assistant setup.

Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use."

[joepeeples]

Thanks @jamesspi! If it's open for editing, this revises for slightly more active voice and clearer distinction between Elastic and the provider:

"Elastic does not store or examine prompts sent to or results generated by the AI Assistant, nor does Elastic use the data for any future training or context. This data is sent to and processed by the third-party provider that you choose when setting up the Generative AI connector, as part of the assistant setup. This includes any data used in conversations for analysis or context, such as alert or event data, detection rule configurations, and queries.

Elastic does not have any control over the third-party tools, and we have no responsibility or liability for their content, operation, or use, nor for any loss or damage that may arise from your using such tools. Please exercise caution when using AI tools with personal, sensitive, or confidential information. Any data you submit may be used by the provider for AI training or other purposes. There is no guarantee that the provider will keep any information you provide secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use."

Let me know if this works (you can check the edit history of this comment to see a diff). This also adds a sentence from the existing Important callout, which the new blurb partly replaces since it covers the same points. The whole text is getting kind of long for a callout, so I'll tinker with making it a full section with a heading -- I'll share a draft soon so you can see what it could look like.

[jamesspi]

Thanks @joepeeples , LGTM.

Also, the existing callout mentions that we do not anonymize data. This, as you know, is changing in 8.9. Just want to make sure it's on our radar to update.

Thanks!

[joepeeples]

Also, the existing callout mentions that we do not anonymize data. This, as you know, is changing in 8.9. Just want to make sure it's on our radar to update.

@jamesspi Yes, forgot to mention that I'll remove the original's anonymization wording in the callout when I revise this. And @benironside will be working on the new anonymization features themselves. Thanks for your feedback!