You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: solutions/security/ai/ai-assistant.md
+19-10Lines changed: 19 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ applies_to:
10
10
11
11
# AI Assistant
12
12
13
-
The Elastic AI Assistant utilizes generative AI to bolster your cybersecurity operations team. It allows users to interact with {{elastic-sec}} for tasks such as alert investigation, incident response, and query generation or conversion using natural language and much more.
13
+
The Elastic AI Assistant utilizes generative AI to bolster your cybersecurity operations team. It allows users to interact with {{elastic-sec}} for tasks such as alert investigation, incident response, and query generation or conversation using natural language and much more.
@@ -75,7 +75,7 @@ You can also chat with AI Assistant from several particular pages in {{elastic-s
75
75
*[Data Quality dashboard](/solutions/security/dashboards/data-quality-dashboard.md): Select the **Incompatible fields** tab, then click **Chat**. (This is only available for fields marked red, indicating they’re incompatible).
76
76
77
77
::::{note}
78
-
Each user’s chat history (up to the 99 most recent conversations) and custom Quick Prompts are automatically saved, so you can leave {{elastic-sec}} and return to a conversation later. Chat history appears to the left of the AI Assistant chat window, and on the **Conversations** tab of the **AI Assistant settings** menu. To access the settings menu, use the global search field to search for "AI Assistant for Security".
78
+
Each user’s chat history (up to the 99 most recent conversations) and custom Quick Prompts are automatically saved, so you can leave {{elastic-sec}} and return to a conversation later. Chat history appears to the left of the AI Assistant chat window, and on the **Conversations** tab of the **AI Assistant settings** menu. To access the settings menu, use the global search field to search for "AI Assistant for Security" or open the menu in the upper-right of the AI Assistant chat window.
79
79
::::
80
80
81
81
@@ -87,16 +87,16 @@ Use these features to adjust and act on your conversations with AI Assistant:
87
87
* (Optional) Select a *System Prompt* at the beginning of a conversation by using the **Select Prompt** menu. System Prompts provide context to the model, informing its response. To create a System Prompt, open the System Prompts dropdown menu and click **+ Add new System Prompt…**.
88
88
* (Optional) Select a *Quick Prompt* at the bottom of the chat window to get help writing a prompt for a specific purpose, such as summarizing an alert or converting a query from a legacy SIEM to {{elastic-sec}}.
:alt: The Security AI settings menu's System Prompts tab
99
+
:::
100
100
101
101
* Quick Prompt availability varies based on context—for example, the **Alert summarization** Quick Prompt appears when you open AI Assistant while viewing an alert. To customize existing Quick Prompts and create new ones, click **Add Quick Prompt**.
102
102
* In an active conversation, you can use the inline actions that appear on messages to incorporate AI Assistant’s responses into your workflows:
@@ -117,7 +117,16 @@ AI Assistant can remember particular information you tell it to remember. For ex
117
117
118
118
## Configure AI Assistant [configure-ai-assistant]
119
119
120
-
The **Security AI settings** page allows you to configure AI Assistant. To access it, use the global search field to search for "AI Assistant for Security".
120
+
To adjust AI Assistant's settings from the chat window, click the **More** (three dots) button in the upper-right.
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Chat options** affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the knowledge base, and content from Elastic's Security Labs and product documentation.
128
+
129
+
The **Security AI settings** page provides a range of configuration options for AI Assistant. To access it directly, use the global search field to search for "AI Assistant for Security".
By default, Attack Discovery analyzes up to 100 alerts from the last 24 hours, but you can customize how many and which alerts it analyzes using the settings menu. To open it, click the gear icon next to the **Generate** button.
You can select which alerts Attack Discovery will process by filtering based on a KQL query, the time and date selector, and the **Number of alerts** slider. Note that sending more alerts than your chosen LLM can handle may result in an error. Under **Alert summary** you can view a summary of the selected alerts grouped by various fields, and under **Alerts preview** you can see more details about the selected alerts.
48
+
49
+
:::{admonition} How to add non-ECS fields to Attack Discovery
50
+
Attack Discovery is designed for use with alerts based on data that complies with ECS, and by default only analyses ECS-compliant fields. However, you can enable Attack Discovery to review additional fields by following these steps:
51
+
52
+
1. Select an alert with some of the non-ECS fields you want to analyze, and go to its details flyout. From here, use the **Chat** button to open AI Assistant.
53
+
2. At the bottom of the chat window, the alert's information appears. Click **Edit** to open the anonymization window to this alert's fields.
54
+
3. Search for and select the non-ECS fields you want Attack Discovery to analyze. Set them to **Allowed**.
55
+
56
+
The selected fields can now be analyzed the next time you run Attack Discovery.
When you access Attack Discovery for the first time, you’ll need to select an LLM connector before you can analyze alerts. Attack Discovery uses the same LLM connectors as [AI Assistant](/solutions/security/ai/ai-assistant.md). To get started:
61
+
You’ll need to select an LLM connector before you can analyze alerts. Attack Discovery uses the same LLM connectors as [AI Assistant](/solutions/security/ai/ai-assistant.md). To get started:
41
62
42
63
1. Click the **Attack Discovery** page from {{elastic-sec}}'s navigation menu.
43
64
2. Select an existing connector from the dropdown menu, or add a new one.
@@ -54,26 +75,13 @@ When you access Attack Discovery for the first time, you’ll need to select an
54
75
55
76
3. Once you’ve selected a connector, click **Generate** to start the analysis.
56
77
57
-
It may take from a few seconds up to several minutes to generate discoveries, depending on the number of alerts and the model you selected.
58
-
59
-
::::{important}
60
-
By default, Attack Discovery analyzes up to 100 alerts within this timeframe, but you can expand this up to 500 by clicking the settings icon (![Settings icon](/solutions/images/security-icon-settings.png"title =20x20")) next to the model selection menu and adjusting the **Alerts** slider. Note that sending more alerts than your chosen LLM can handle may result in an error.
It may take from a few seconds up to several minutes to generate discoveries, depending on the number of alerts and the model you selected. Once the analysis is complete, any threats it identifies will appear as discoveries. Click each one’s title to expand or collapse it. Click **Generate** at any time to start the Attack Discovery process again with the selected alerts.
68
79
69
80
::::{important}
70
81
Attack Discovery uses the same data anonymization settings as [Elastic AI Assistant](/solutions/security/ai/ai-assistant.md). To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
71
82
::::
72
83
73
84
74
-
Once the analysis is complete, any threats it identifies will appear as discoveries. Click each one’s title to expand or collapse it. Click **Generate** at any time to start the Attack Discovery process again with the most current alerts.
75
-
76
-
77
85
## What information does each discovery include? [attack-discovery-what-info]
78
86
79
87
Each discovery includes the following information describing the potential threat, generated by the connected LLM:
Copy file name to clipboardExpand all lines: solutions/security/ai/connect-to-amazon-bedrock.md
+8-6Lines changed: 8 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ applies_to:
13
13
This page provides step-by-step instructions for setting up an Amazon Bedrock connector for the first time. This connector type enables you to leverage large language models (LLMs) within {{kib}}. You’ll first need to configure AWS, then configure the connector in {{kib}}.
14
14
15
15
::::{note}
16
-
Only Amazon Bedrock’s `Anthropic` models are supported: `Claude` and `Claude instant`.
16
+
All models in Amazon Bedrock's `Claude` model group are supported.
17
17
::::
18
18
19
19
@@ -99,7 +99,7 @@ Make sure the supported Amazon Bedrock LLMs are enabled:
99
99
1. Search the AWS console for Amazon Bedrock.
100
100
2. From the Amazon Bedrock page, click **Get started**.
101
101
3. Select **Model access** from the left navigation menu, then click **Manage model access**.
102
-
4. Check the boxes for **Claude** and/or **Claude Instant**, depending which model or models you plan to use.
102
+
4. Check the box for the model or models you plan to use.
103
103
5. Click **Save changes**.
104
104
105
105
The following video demonstrates these steps (click to watch).
@@ -115,11 +115,13 @@ Finally, configure the connector in {{kib}}:
115
115
2. Find the **Connectors** page in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Then click **Create Connector**, and select **Amazon Bedrock**.
116
116
3. Name your connector.
117
117
4. (Optional) Configure the Amazon Bedrock connector to use a different AWS region where Anthropic models are supported by editing the **URL** field, for example by changing `us-east-1` to `eu-central-1`.
118
-
5. (Optional) Add one of the following strings if you want to use a model other than the default:
118
+
5. (Optional) Add one of the following strings if you want to use a model other than the default. Note that these URLs should have a prefix of `us.` or `eu.`, depending on your region, for example `us.anthropic.claude-3-5-sonnet-20240620-v1:0` or `eu.anthropic.claude-3-5-sonnet-20240620-v1:0`.
119
119
120
-
* For Haiku: `anthropic.claude-3-haiku-20240307-v1:0`
121
-
* For Sonnet: `anthropic.claude-3-sonnet-20240229-v1:0`
122
-
* For Opus: `anthropic.claude-3-opus-20240229-v1:0`
120
+
* Sonnet 3.5: `us.anthropic.claude-3-5-sonnet-20240620-v1:0` or `eu.anthropic.claude-3-5-sonnet-20240620-v1:0`
121
+
* Sonnet 3.5 v2: `us.anthropic.claude-3-5-sonnet-20241022-v2:0` or `eu.anthropic.claude-3-5-sonnet-20241022-v2:0`
122
+
* Sonnet 3.7: `us.anthropic.claude-3-7-sonnet-20250219-v1:0` or `eu.anthropic.claude-3-7-sonnet-20250219-v1:0`
123
+
* Haiku 3.5: `us.anthropic.claude-3-5-haiku-20241022-v1:0` or `eu.anthropic.claude-3-5-haiku-20241022-v1:0`
124
+
* Opus: `us.anthropic.claude-3-opus-20240229-v1:0` or `eu.anthropic.claude-3-opus-20240229-v1:0`
123
125
124
126
6. Enter the **Access Key** and **Secret** that you generated earlier, then click **Save**.
Copy file name to clipboardExpand all lines: solutions/security/ai/identify-investigate-document-threats.md
+6-1Lines changed: 6 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,12 @@ In this guide, you’ll learn how to:
22
22
23
23
## Use Attack discovery to identify threats [use-case-incident-reporting-use-attack-discovery-to-identify-threats]
24
24
25
-
Attack discovery can detect a wide range of threats by finding relationships among alerts that may indicate a coordinated attack. This enables you to comprehend how threats move through and affect your systems. Attack discovery generates a detailed summary of each potential threat, which can serve as the basis for further analysis. Learn how to [get started with Attack discovery](/solutions/security/ai/attack-discovery.md).
25
+
Attack discovery can detect a wide range of threats by finding relationships among alerts that may indicate a coordinated attack. This enables you to comprehend how threats move through and affect your systems. Attack discovery generates a detailed summary of each potential threat and can highlight avenues for further investigation. Learn how to [get started with Attack discovery](/solutions/security/ai/attack-discovery.md).
26
+
27
+
:::{important}
28
+
To ensure that Attack Discovery analyzes related alerts together (and can therefore identify their connections), pay attention to the [alert filtering](/solutions/security/ai/attack-discovery.md) settings. This allows you to target Attack Discovery at specific groups of alerts, such as those related to a particular host, user, date and time, incident, or customer.
Copy file name to clipboardExpand all lines: solutions/security/ai/set-up-connectors-for-large-language-models-llm.md
+21-4Lines changed: 21 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -8,17 +8,34 @@ applies_to:
8
8
security: all
9
9
---
10
10
11
-
# Set up connectors for large language models (LLM)
11
+
# Enable large language model (LLM) access
12
12
13
-
This section contains instructions for setting up connectors for LLMs so you can use [Elastic AI Assistant](/solutions/security/ai/ai-assistant.md) and [Attack discovery](/solutions/security/ai/attack-discovery.md).
13
+
{{elastic-sec}} uses large language models (LLMs) for some of its advanced analytics features. To enable these features, you can connect to Elastic LLM, a third-party LLM provider, or a custom local LLM.
14
14
15
-
Setup guides are available for the following LLM providers:
15
+
:::{important}
16
+
Different LLMs have varying performance when used to power different features and use-cases. For more information about how various models perform on different tasks in {{elastic-sec}}, refer to the [Large language model performance matrix](/solutions/security/ai/large-language-model-performance-matrix.md).
17
+
:::
18
+
19
+
20
+
## Connect to Elastic LLM
21
+
22
+
Elastic LLM is enabled by default for any user with the necessary Elastic license or subscription. To use it:
23
+
24
+
1. Navigate to a feature that uses an LLM, such as AI Assistant.
25
+
2. Use the model selection menu to select the Elastic LLM*.
26
+
27
+
## Connect to a third-party LLM
28
+
29
+
Follow these guides to connect to one or more third-party LLM providers:
Copy file name to clipboardExpand all lines: solutions/security/ai/use-cases.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -8,9 +8,9 @@ applies_to:
8
8
security: all
9
9
---
10
10
11
-
# Use cases
11
+
# Example AI workflows
12
12
13
-
The guides in this section describe use cases for AI Assistant and Attack discovery. Refer to them for examples of each tool’s individual capabilities and of what they can do together.
13
+
The guides in this section describe example workflows for AI Assistant and Attack discovery. Refer to them for examples of each tool’s individual capabilities and how they can work together.
0 commit comments