This repository has been archived by the owner on Mar 28, 2024. It is now read-only.
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution] Elastic Security Assistant (elastic#156933)
## [Security Solution] Elastic Security Assistant The _Elastic Security Assistant_ has entered the chat, integrating generative AI and large language models (LLMs) into the workflows of Elastic Security users. Bring your alerts, events, rules, and data quality checks into the conversation. <https://github.com/elastic/kibana/assets/2946766/31d65c78-5692-4817-b726-820c5df0801c> This PR merges a feature branch developed by @spong and @andrew-goldstein , seeded by @jamesspi 's prototype of the assistant. Connectivity to LLMs is provided the [Generative AI Connector](<elastic#157228>) , developed by @stephmilovic . This PR includes: - A new reusable Kibana package containing the assistant: `x-pack/packages/kbn-elastic-assistant` - See the `How to embed the Assistant in other parts of Kibana` for details - Assistant integration into Elastic Security Solution workflows (e.g. alerts, cases, Timeline, rules, data quality) ### An assistant trained on the Elastic stack and Elastic Security The [Generative AI Connector](<elastic#157228>) connects the assistant to OpenAI and Azure OpenAI models trained with knowledge of the Elastic stack and the Elastic Security solution, including: - The Elastic open [Detection Rules](https://github.com/elastic/detection-rules) - The [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/index.html) - Elastic query languages, including [KQL](https://www.elastic.co/guide/en/kibana/current/kuery-query.html), [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html), and the [Elastic Query DSL](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html) - [Elasticsearch API documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/rest-apis.html) This training enables the assistant to offer fully interactive chat experiences that include: - alert summarization - interactive query generation - workflow suggestions - generating ingestion configurations that conform to the Elastic Common Schema - your imagination using context from Elastic Security. ### Take action from your conversations The Actions (from assistant response): - Send KQL to Timeline - Send EQL to Timeline - Send Elasticsearch DSL to Timeline - Send Note to timeline - Create new case - Add to existing case - Copy to clipboard ### Components architecture diagram  ### How to embed the Assistant in other parts of Kibana Follow the general instructions in `x-pack/packages/kbn-elastic-assistant/index.ts` to integrate the assistant into a Kibana app. #### Step 1 - Wrap your Kibana app in the `AssistantProvider` component ```ts // Step 1: Wrap your Kibana app in the `AssistantProvider` component. This typically // happens in the root of your app. Optionally provide a custom title for the assistant: /** provides context (from the app) to the assistant, and injects Kibana services, like `http` */ export { AssistantProvider } from './impl/assistant_context'; ``` #### Step 2: Add the `AssistantOverlay` component to your app ```ts // Step 2: Add the `AssistantOverlay` component to your app. This component displays the assistant // overlay in a modal, bound to a shortcut key: /** modal overlay for Elastic Assistant conversations */ export { AssistantOverlay } from './impl/assistant/assistant_overlay'; // In addition to the `AssistantOverlay`, or as an alternative, you may use the `Assistant` component // to display the assistant without the modal overlay: /** this component renders the Assistant without the modal overlay to, for example, render it in a Timeline tab */ export { Assistant } from './impl/assistant'; ``` #### Step 3: Wherever you want to bring context into the assistant, use the any combination of the following ```ts // Step 3: Wherever you want to bring context into the assistant, use the any combination of the following // components and hooks: // - `NewChat` component // - `NewChatById` component // - `useAssistantOverlay` hook /** * `NewChat` displays a _New chat_ icon button, providing all the context * necessary to start a new chat. You may optionally style the button icon, * or override the default _New chat_ text with custom content, like `🪄✨` * * USE THIS WHEN: All the data necessary to start a new chat is available * in the same part of the React tree as the _New chat_ button. */ export { NewChat } from './impl/new_chat'; /** * `NewChatByID` displays a _New chat_ icon button by providing only the `promptContextId` * of a context that was (already) registered by the `useAssistantOverlay` hook. You may * optionally style the button icon, or override the default _New chat_ text with custom * content, like {'🪄✨'} * * USE THIS WHEN: all the data necessary to start a new chat is NOT available * in the same part of the React tree as the _New chat_ button. When paired * with the `useAssistantOverlay` hook, this option enables context to be be * registered where the data is available, and then the _New chat_ button can be displayed * in another part of the tree. */ export { NewChatById } from './impl/new_chat_by_id'; /** * `useAssistantOverlay` is a hook that registers context with the assistant overlay, and * returns an optional `showAssistantOverlay` function to display the assistant overlay. * As an alterative to using the `showAssistantOverlay` returned from this hook, you may * use the `NewChatById` component and pass it the `promptContextId` returned by this hook. * * USE THIS WHEN: You want to register context in one part of the tree, and then show * a _New chat_ button in another part of the tree without passing around the data, or when * you want to build a custom `New chat` button with features not not provided by the * `NewChat` component. */ export { useAssistantOverlay } from './impl/assistant/use_assistant_overlay'; ``` Co-authored-by: Garrett Spong <garrett.spong@elastic.co> Co-authored-by: Andrew Macri <andrew.macri@elastic.co>
- Loading branch information
3 people
authored and
committed
Jun 6, 2023
1 parent
02d2288
commit ce0cbf3