[Security solution] Add additional properties to attack discovery telemetry #182249
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
stephmilovic
added
release_note:skip
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
| reportAttackDiscoveriesGenerated({ | ||
| actionTypeId, | ||
| durationMs, | ||
| alertCount: knowledgeBase.latestAlerts, |
There was a problem hiding this comment.
Consider something like:
uniq(
selectedConnectorAttackDiscoveries.flatMap((attackDiscovery) => attackDiscovery.alertIds)
).length,to calculate alertCount, and adding an additional stat like configuredAlertsCount to represent the value of knowledgeBase.latestAlerts.
| @@ -11,6 +11,7 @@ import { | |||
| useAssistantContext, | |||
| useLoadConnectors, | |||
| } from '@kbn/elastic-assistant'; | |||
| import { uniq } from 'lodash'; | |||
There was a problem hiding this comment.
nit: consider lodash/fp
| alertsCount: { | ||
| type: 'integer', | ||
| _meta: { | ||
| description: 'Number of alerts evaluated', |
There was a problem hiding this comment.
nit: Consider something like Number of unique alerts referenced in the attack discoveries, because this may be less than the number of alerts evaluated.
Comment on lines
30
to
41
| if (!connector?.isPreconfigured) { | ||
| const config = (connector as ActionConnectorProps<GenAiConfig, unknown>)?.config; | ||
| if (config?.apiProvider === OpenAiProviderType.AzureAi) { | ||
| return { | ||
| ...config, | ||
| defaultModel: getAzureApiVersionParameter(config.apiUrl ?? ''), | ||
| }; | ||
| } | ||
|
|
||
| return (connector as ActionConnectorProps<GenAiConfig, unknown>)?.config; | ||
| } | ||
| return undefined; |
There was a problem hiding this comment.
Consider something like the following to eliminate the second cast and most references to config:
if (!connector?.isPreconfigured) {
const config = (connector as ActionConnectorProps<GenAiConfig, unknown>)?.config;
const { apiProvider, apiUrl, defaultModel } = config ?? {};
return {
apiProvider,
apiUrl,
defaultModel:
apiProvider === OpenAiProviderType.AzureAi
? getAzureApiVersionParameter(apiUrl ?? '')
: defaultModel,
};
}
return undefined; // the connector is neither available nor editable
andrew-goldstein
approved these changes
May 2, 2024
There was a problem hiding this comment.
Thanks for the additional telemetry @stephmilovic!
✅ Desk tested locally
LGTM 🚀
💚 Build Succeeded
The CI Stats report is too large to be displayed here, check out the CI build annotation for this information. History
To update your PR or re-run it, just comment with: |
💔 All backports failed
Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
stephmilovic
added a commit
to stephmilovic/kibana
that referenced
this pull request
May 8, 2024
…emetry (elastic#182249) (cherry picked from commit e306074) # Conflicts: # .github/CODEOWNERS
stephmilovic
added a commit
that referenced
this pull request
May 8, 2024
…ery telemetry (#182249) (#182997) # Backport This will backport the following commits from `main` to `8.14`: - [[Security solution] Add additional properties to attack discovery telemetry (#182249)](#182249) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Steph Milovic","email":"stephanie.milovic@elastic.co"},"sourceCommit":{"committedDate":"2024-05-02T04:48:36Z","message":"[Security solution] Add additional properties to attack discovery telemetry (#182249)","sha":"e306074aa9e8943ab342270a6f795e17ee37c1da","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team: SecuritySolution","Team:Security Generative AI","v8.14.0","v8.15.0","Feature:Attack Discovery"],"number":182249,"url":"#182249 solution] Add additional properties to attack discovery telemetry (#182249)","sha":"e306074aa9e8943ab342270a6f795e17ee37c1da"}},"sourceBranch":"main","suggestedTargetBranches":["8.14"],"targetPullRequestStates":[{"branch":"8.14","label":"v8.14.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.15.0","labelRegex":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"#182249 solution] Add additional properties to attack discovery telemetry (#182249)","sha":"e306074aa9e8943ab342270a6f795e17ee37c1da"}}]}] BACKPORT-->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Adds 3 new properties to the
reportAttackDiscoveriesGeneratedtelemetry event:durationMs,alertsCount, andconfiguredAlertsCount. These fields represent how long the request took, how many alerts were used for the generation, and how many alerts were configured by the user for the generation.I also added the
providerandmodelarguments which were already defined, but not passed. Here is an example of what this looks like for Bedrock and Azure:CODEOWNERS change
Added the
attack_discoverydir to be under @elastic/security-generative-ai ownership 👍