Skip to content

Commit 571131d

Browse files
benironsidejmikell821nastasha-solomon
authored
Documents Attack Discovery (#342)
* first draft * troubleshoots docnav * updates Docnav * incorporates Dhru's feedback * minor edits * line edit * Removes unnecessary link * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> * incorporates Janeen's review * Update docs/attack-discovery/attack-discovery.mdx Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * incorporates Nastasha's feedback * removes unnecessary link * Incorporates Joe's review * Adds note to AI Assistant page * fixes note * minor updates * moves period * adds missing "to" * Incorporates Janeen's feedback --------- Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
1 parent 590744c commit 571131d

File tree

6 files changed

+76
-1
lines changed

6 files changed

+76
-1
lines changed

‎docs/assistant/ai-assistant.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ You can also chat with AI Assistant from several particular pages in ((elastic-s
7777
* <DocLink id="serverlessSecurityTimelinesUi">Timeline</DocLink>: Select the **Security Assistant** tab.
7878

7979
<DocCallOut title="Note">
80-
Each user's chat history and custom quick prompts are automatically saved, so you can leave ((elastic-sec)) and return to pick up a conversation later.
80+
Each user's chat history and custom quick prompts are automatically saved, so you can leave ((elastic-sec)) and return to pick up a conversation later. Chat history is saved in the `.kibana-elastic-ai-assistant-conversations` data stream.
8181
</DocCallOut>
8282

8383
<div id="interact-with-assistant"></div>

‎docs/attack-discovery/attack-discovery.mdx‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
id: attackDiscovery
3+
slug: /serverless/security/attack-discovery
4+
title: Attack discovery
5+
description: Accelerate threat identification by triaging alerts with a large language model.
6+
tags: [ 'serverless', 'security', 'overview', 'LLM', 'artificial intelligence' ]
7+
status: in review
8+
---
9+
10+
<DocBadge template="beta" />
11+
12+
Attack discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This makes the most of each security analyst's time, helps fight alert fatigue, and can reduce your mean time to respond.
13+
14+
<DocCallOut title="Note">
15+
Attack discovery currently only analyzes alerts from the past 24 hours.
16+
</DocCallOut>
17+
18+
This page describes:
19+
20+
- <DocLink id="attackDiscovery" section="generate-discoveries">How to start generating discoveries</DocLink>
21+
- <DocLink id="attackDiscovery" section="discovery-info">What information each discovery includes</DocLink>
22+
- <DocLink id="attackDiscovery" section="workflows">How you can interact with discoveries to enhance ((elastic-sec)) workflows</DocLink>.
23+
24+
25+
<div id="generate-discoveries"></div>
26+
## Generate discoveries
27+
28+
To use Attack discovery:
29+
30+
1. Click the **Attack discovery** page from ((elastic-sec))'s navigation menu.
31+
32+
2. When you open the page for the first time, you'll need to select an LLM connector before you can analyze alerts. Select an existing connector from the dropdown menu, or add a new one.
33+
34+
<DocCallOut title="Note">
35+
Attack discovery uses the same LLM connectors as <DocLink id="serverlessSecurityAIAssistant">Elastic AI Assistant</DocLink>. If you've already configured one, you can use it here without further configuration. In general, models with larger context windows are more effective for Attack discovery.
36+
</DocCallOut>
37+
38+
![Attack discovery empty state](../images/attack-discovery/select-model-empty-state.png)
39+
40+
3. Once you've selected a connector, click **Generate** to start the analysis.
41+
42+
It may take from a few seconds up to several minutes to generate discoveries, depending on the number of alerts and the model you selected.
43+
44+
<DocCallOut title="Important">
45+
Attack discovery uses the same data anonymization settings as <DocLink id="serverlessSecurityAIAssistant">Elastic AI Assistant</DocLink>. To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
46+
</DocCallOut>
47+
48+
Once the analysis is complete, any threats it identifies will appear as discoveries. Click each one's title to expand or collapse it. Click **Generate** at any time to start the Attack discovery process again with the most current alerts.
49+
50+
<div id="discovery-info"></div>
51+
## What information does each discovery include?
52+
53+
Each discovery includes the following information describing the potential threat, generated by the connected LLM:
54+
55+
- A descriptive title and a summary of the potential threat.
56+
- The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to.
57+
- The implicated entities (users and hosts), and what suspicious activity was observed for each.
58+
59+
![Attack discovery detail view](../images/attack-discovery/attack-discovery-full-card.png)
60+
61+
<div id="workflows"></div>
62+
## Incorporate discoveries with other workflows
63+
64+
There are several ways you can incorporate discoveries into your ((elastic-sec)) workflows:
65+
66+
- Click an entity's name to open the user or host details flyout and view more details that may be relevant to your investigation.
67+
- Hover over an entity's name to either add the entity to Timeline (<DocIcon type="timeline" title="Timeline" />) or copy its field name and value to the clipboard (<DocIcon type="copyClipboard" title="Copy to clipboard"/>).
68+
- Click **Take action**, then select **Add to new case** or **Add to existing case** to add a discovery to a case. This makes it easy to share the information with your team and other stakeholders.
69+
- Click **Investigate in timeline** to explore the discovery in Timeline.
70+
- Click **View in AI Assistant** to attach the discovery to a conversation with AI Assistant. You can then ask follow up questions about the discovery or associated alerts.
71+
72+
![Attack discovery view in AI Assistant](../images/attack-discovery/add-discovery-to-assistant.gif)

‎docs/images/attack-discovery/add-discovery-to-assistant.gif‎

7.46 MB
Loading

‎docs/images/attack-discovery/attack-discovery-full-card.png‎

112 KB
Loading

‎docs/images/attack-discovery/select-model-empty-state.png‎

66.8 KB
Loading

‎serverless-security.docnav.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
"pageId": "serverlessSecurityEsUiOverview",
2020
"classic-sources": [ "enSecurityEsUiOverview" ]
2121
},
22+
{
23+
"pageId": "attackDiscovery"
24+
},
2225
{
2326
"label": "Elastic AI Assistant",
2427
"pageId": "serverlessSecurityAIAssistant",

0 commit comments

Comments
 (0)