github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 17:59:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

[8.18] [Security Solution] Onboarding check inference endpoint (#217150) (#217335)

Browse source 
# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Onboarding check inference endpoint
(#217150)](https://github.com/elastic/kibana/pull/217150)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Sergi
Massaneda","email":"sergi.massaneda@elastic.co"},"sourceCommit":{"committedDate":"2025-04-07T13:43:39Z","message":"[Security
Solution] Onboarding check inference endpoint (#217150)\n\n##
Summary\n\nThis PR checks that the inference endpoint exists before
showing the\ninference connector in the list of selectable
connectors.\n\nAlso, it removes code duplication by centralizing the
implementation in\nthe /common/connectors directory of the onboarding
cards\n\n\n![siem_migrations_connector_card](99ddd69d-18c7-41be-bec0-45524d718d08)\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"7b934f903499d1affd1986fedb0529f51d5c818c","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Threat
Hunting","Team:Threat
Hunting:Explore","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Onboarding check inference
endpoint","number":217150,"url":"https://github.com/elastic/kibana/pull/217150","mergeCommit":{"message":"[Security
Solution] Onboarding check inference endpoint (#217150)\n\n##
Summary\n\nThis PR checks that the inference endpoint exists before
showing the\ninference connector in the list of selectable
connectors.\n\nAlso, it removes code duplication by centralizing the
implementation in\nthe /common/connectors directory of the onboarding
cards\n\n\n![siem_migrations_connector_card](99ddd69d-18c7-41be-bec0-45524d718d08)\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"7b934f903499d1affd1986fedb0529f51d5c818c"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/217150","number":217150,"mergeCommit":{"message":"[Security
Solution] Onboarding check inference endpoint (#217150)\n\n##
Summary\n\nThis PR checks that the inference endpoint exists before
showing the\ninference connector in the list of selectable
connectors.\n\nAlso, it removes code duplication by centralizing the
implementation in\nthe /common/connectors directory of the onboarding
cards\n\n\n![siem_migrations_connector_card](99ddd69d-18c7-41be-bec0-45524d718d08)\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"7b934f903499d1affd1986fedb0529f51d5c818c"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
This commit is contained in:
Sergi Massaneda 2025-04-07 17:59:41 +02:00 • committed by GitHub
parent 2334c67609
commit dd7dae0f16
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
12 changed files with 261 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

4
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_card.tsx
View file

@ -113,6 +113,10 @@ export const AssistantCard: OnboardingCardComponent<AssistantCardMetadata> = ({
provider: apiProvider,
model,
},
}).catch(() => {
// If the conversation is not found, it means the connector was deleted
// and return null to avoid setting the conversation
return null;
});
if (conversation && onConversationChange != null) {

41
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_check_complete.ts
View file

@ -5,43 +5,32 @@
* 2.0.
*/
import { loadAllActions as loadConnectors } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
import type { AIConnector } from '@kbn/elastic-assistant/impl/connectorland/connector_selector';
import { i18n } from '@kbn/i18n';
import type { OnboardingCardCheckComplete } from '../../../../types';
import { AIActionTypeIds } from '../common/connectors/constants';
import { loadAiConnectors } from '../common/connectors/ai_connectors';
import { getConnectorsAuthz } from '../common/connectors/authz';
import type { AssistantCardMetadata } from './types';
const completeBadgeText = (count: number) =>
i18n.translate('xpack.securitySolution.onboarding.assistantCard.badge.completeText', {
defaultMessage: '{count} AI {count, plural, one {connector} other {connectors}} added',
values: { count },
});
export const checkAssistantCardComplete: OnboardingCardCheckComplete<
AssistantCardMetadata
> = async ({ http, application }) => {
const allConnectors = await loadConnectors({ http });
const {
capabilities: { actions },
} = application;
const authz = getConnectorsAuthz(application.capabilities);
const aiConnectors = allConnectors.reduce((acc: AIConnector[], connector) => {
if (!connector.isMissingSecrets && AIActionTypeIds.includes(connector.actionTypeId)) {
acc.push(connector);
}
return acc;
}, []);
if (!authz.canReadConnectors) {
return { isComplete: false, metadata: { connectors: [], ...authz } };
}
const completeBadgeText = i18n.translate(
'xpack.securitySolution.onboarding.assistantCard.badge.completeText',
{
defaultMessage: '{count} AI {count, plural, one {connector} other {connectors}} added',
values: { count: aiConnectors.length },
}
);
const aiConnectors = await loadAiConnectors(http);
return {
isComplete: aiConnectors.length > 0,
completeBadgeText,
metadata: {
connectors: aiConnectors,
canExecuteConnectors: Boolean(actions?.show && actions?.execute),
canCreateConnectors: Boolean(actions?.save),
},
completeBadgeText: completeBadgeText(aiConnectors.length),
metadata: { connectors: aiConnectors, ...authz },
};
};

2
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/translations.ts
View file

@ -18,7 +18,7 @@ export const ASSISTANT_CARD_DESCRIPTION = i18n.translate(
'xpack.securitySolution.onboarding.assistantCard.description',
{
defaultMessage:
'The Elastic AI connector is currently configured, powered by OpenAI gpt 4.0 for optimal performance for migrating SIEM rules. However,any AI service provider can be configured. Read more about AI provider performance and other Elastic powered by AI features.',
'Choose and configure any AI provider available to use with Elastic AI Assistant.',
}
);

5
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/types.ts
View file

@ -6,9 +6,8 @@
*/
import type { ActionConnector } from '@kbn/alerts-ui-shared';
import type { ConnectorsAuthz } from '../common/connectors/authz';
export interface AssistantCardMetadata {
export interface AssistantCardMetadata extends ConnectorsAuthz {
connectors: ActionConnector[];
canExecuteConnectors: boolean;
canCreateConnectors: boolean;
}

126
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/ai_connectors.test.ts Normal file
View file

@ -0,0 +1,126 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import { loadAiConnectors } from './ai_connectors';
import { loadAllActions } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
import { isInferenceEndpointExists } from '@kbn/inference-endpoint-ui-common';
import type { HttpSetup } from '@kbn/core-http-browser';
import type { ActionConnector } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
jest.mock('@kbn/triggers-actions-ui-plugin/public/common/constants', () => ({
loadAllActions: jest.fn(),
}));
jest.mock('@kbn/inference-endpoint-ui-common', () => ({
isInferenceEndpointExists: jest.fn(),
}));
const mockHttp = {} as HttpSetup;
const mockLoadAllActions = loadAllActions as jest.Mock;
const mockIsInferenceEndpointExists = isInferenceEndpointExists as jest.Mock;
describe('loadAiConnectors', () => {
beforeEach(() => {
jest.clearAllMocks();
});
it('should return only valid external AI connectors', async () => {
const mockConnectors: ActionConnector[] = [
{ id: '1', actionTypeId: '.gen-ai', isMissingSecrets: false } as ActionConnector,
{ id: '2', actionTypeId: '.gen-ai', isMissingSecrets: true } as ActionConnector,
{ id: '3', actionTypeId: '.webhook', isMissingSecrets: false } as ActionConnector,
];
mockLoadAllActions.mockResolvedValue(mockConnectors);
const result = await loadAiConnectors(mockHttp);
expect(result).toEqual([{ id: '1', actionTypeId: '.gen-ai', isMissingSecrets: false }]);
});
it('should include valid preconfigured inference connectors with existing endpoint', async () => {
const mockConnectors: ActionConnector[] = [
{
id: '1',
actionTypeId: '.inference',
isMissingSecrets: false,
isPreconfigured: true,
config: { inferenceId: 'my-inference' },
} as unknown as ActionConnector,
];
mockLoadAllActions.mockResolvedValue(mockConnectors);
mockIsInferenceEndpointExists.mockResolvedValue(true);
const result = await loadAiConnectors(mockHttp);
expect(mockIsInferenceEndpointExists).toHaveBeenCalledWith(mockHttp, 'my-inference');
expect(result).toEqual(mockConnectors);
});
it('should exclude inference connectors if endpoint does not exist', async () => {
const mockConnectors: ActionConnector[] = [
{
id: '1',
actionTypeId: '.inference',
isMissingSecrets: false,
isPreconfigured: true,
config: { inferenceId: 'missing' },
} as unknown as ActionConnector,
];
mockLoadAllActions.mockResolvedValue(mockConnectors);
mockIsInferenceEndpointExists.mockResolvedValue(false);
const result = await loadAiConnectors(mockHttp);
expect(result).toEqual([]);
});
it('should exclude inference connectors if it is not configured correctly', async () => {
const mockConnectors: ActionConnector[] = [
{
id: '1',
actionTypeId: '.inference',
isMissingSecrets: false,
isPreconfigured: true,
config: { inferenceId: undefined },
} as unknown as ActionConnector,
];
mockLoadAllActions.mockResolvedValue(mockConnectors);
mockIsInferenceEndpointExists.mockResolvedValue(true);
const result = await loadAiConnectors(mockHttp);
expect(result).toEqual([]);
});
it('should exclude connectors with missing secrets', async () => {
const mockConnectors: ActionConnector[] = [
{ id: '1', actionTypeId: '.bedrock', isMissingSecrets: true } as ActionConnector,
];
mockLoadAllActions.mockResolvedValue(mockConnectors);
const result = await loadAiConnectors(mockHttp);
expect(result).toEqual([]);
});
it('should return an empty array if no connectors are valid', async () => {
const mockConnectors: ActionConnector[] = [
{ id: '1', actionTypeId: '.webhook', isMissingSecrets: false } as ActionConnector,
];
mockLoadAllActions.mockResolvedValue(mockConnectors);
const result = await loadAiConnectors(mockHttp);
expect(result).toEqual([]);
});
});

75
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/ai_connectors.ts Normal file
View file

@ -0,0 +1,75 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { HttpSetup } from '@kbn/core-http-browser';
import { isInferenceEndpointExists } from '@kbn/inference-endpoint-ui-common';
import {
loadAllActions,
type ActionConnector,
} from '@kbn/triggers-actions-ui-plugin/public/common/constants';
const AllowedActionTypeIds = ['.bedrock', '.gen-ai', '.gemini', '.inference'];
type PreConfiguredInferenceConnector = ActionConnector & {
actionTypeId: '.inference';
isPreconfigured: true;
config?: {
inferenceId?: string;
};
};
const isAllowedConnector = (connector: ActionConnector): boolean =>
AllowedActionTypeIds.includes(connector.actionTypeId);
const isPreConfiguredInferenceConnector = (
connector: ActionConnector
): connector is PreConfiguredInferenceConnector =>
connector.actionTypeId === '.inference' && connector.isPreconfigured;
const isValidAiConnector = async (
connector: ActionConnector,
deps: { http: HttpSetup }
): Promise<boolean> => {
if (connector.isMissingSecrets) {
return false;
}
if (!isAllowedConnector(connector)) {
return false;
}
if (isPreConfiguredInferenceConnector(connector)) {
const inferenceId = connector.config?.inferenceId;
if (!inferenceId) {
return false;
}
const exists = await isInferenceEndpointExists(deps.http, inferenceId);
if (!exists) {
return false;
}
}
return true;
};
/**
* Loads all AI connectors that are valid, meaning that they don't miss secrets.
* And in the case of the inference connector, that the inference endpoint exists.
* @param http - The HTTP client to use for making requests.
* @returns A promise that resolves to an array of valid AI connectors.
*/
export const loadAiConnectors = async (http: HttpSetup) => {
const allConnectors = await loadAllActions({ http });
const aiConnectors: ActionConnector[] = [];
for (const connector of allConnectors) {
const isValid = await isValidAiConnector(connector, { http });
if (isValid) {
aiConnectors.push(connector);
}
}
return aiConnectors;
};

24
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/authz.ts Normal file
View file

@ -0,0 +1,24 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { Capabilities } from '@kbn/core/public';
import { CapabilitiesChecker } from '../../../../../../common/lib/capabilities';
export interface ConnectorsAuthz {
canReadConnectors: boolean;
canExecuteConnectors: boolean;
canCreateConnectors: boolean;
}
export const getConnectorsAuthz = (capabilities: Capabilities): ConnectorsAuthz => {
const checker = new CapabilitiesChecker(capabilities);
return {
canReadConnectors: checker.has('actions.show'),
canExecuteConnectors: checker.has([['actions.show', 'actions.execute']]),
canCreateConnectors: checker.has('actions.save'),
};
};

9
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/connector_cards.tsx
View file

@ -5,7 +5,7 @@
* 2.0.
*/
import React, { useCallback, useMemo } from 'react';
import React, { useCallback } from 'react';
import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
import { css } from '@emotion/react';
import { useLoadActionTypes } from '@kbn/elastic-assistant/impl/connectorland/use_load_action_types';
@ -14,7 +14,6 @@ import { ConnectorsMissingPrivilegesCallOut } from './missing_privileges';
import type { AIConnector } from './types';
import { ConnectorSetup } from './connector_setup';
import { ConnectorSelectorPanel } from './connector_selector_panel';
import { AIActionTypeIds } from './constants';
interface ConnectorCardsProps {
onNewConnectorSaved: (connectorId: string) => void;
@ -33,11 +32,7 @@ export const ConnectorCards = React.memo<ConnectorCardsProps>(
onConnectorSelected,
}) => {
const { http, notifications } = useKibana().services;
const { data } = useLoadActionTypes({ http, toasts: notifications.toasts });
const actionTypes = useMemo(
() => data?.filter(({ id }) => AIActionTypeIds.includes(id)),
[data]
);
const { data: actionTypes } = useLoadActionTypes({ http, toasts: notifications.toasts });
const onNewConnectorStoredSave = useCallback(
(newConnector: AIConnector) => {

8
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/constants.ts
View file

@ -1,8 +0,0 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
export const AIActionTypeIds = ['.bedrock', '.gen-ai', '.gemini', '.inference'];

30
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/siem_migrations/ai_connector/connectors_check_complete.ts
View file

@ -5,43 +5,31 @@
* 2.0.
*/
import { loadAllActions as loadConnectors } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
import type { AIConnector } from '@kbn/elastic-assistant/impl/connectorland/connector_selector';
import { CapabilitiesChecker } from '../../../../../../common/lib/capabilities/capabilities_checker';
import type { OnboardingCardCheckComplete } from '../../../../../types';
import { AIActionTypeIds } from '../../common/connectors/constants';
import { loadAiConnectors } from '../../common/connectors/ai_connectors';
import { getConnectorsAuthz } from '../../common/connectors/authz';
import type { AIConnectorCardMetadata } from './types';
export const checkAiConnectorsCardComplete: OnboardingCardCheckComplete<
AIConnectorCardMetadata
> = async ({ http, application, siemMigrations }) => {
let isComplete = false;
const capabilities = new CapabilitiesChecker(application.capabilities);
const authz = getConnectorsAuthz(application.capabilities);
const canExecuteConnectors = capabilities.has([['actions.show', 'actions.execute']]);
const canCreateConnectors = capabilities.has('actions.save');
if (!capabilities.has('actions.show')) {
return { isComplete, metadata: { connectors: [], canExecuteConnectors, canCreateConnectors } };
if (!authz.canReadConnectors) {
return { isComplete, metadata: { connectors: [], ...authz } };
}
const allConnectors = await loadConnectors({ http });
const connectors = allConnectors.reduce<AIConnector[]>((acc, connector) => {
if (!connector.isMissingSecrets && AIActionTypeIds.includes(connector.actionTypeId)) {
acc.push(connector);
}
return acc;
}, []);
const aiConnectors = await loadAiConnectors(http);
const storedConnectorId = siemMigrations.rules.connectorIdStorage.get();
if (storedConnectorId) {
if (connectors.length === 0) {
if (aiConnectors.length === 0) {
siemMigrations.rules.connectorIdStorage.remove();
} else {
isComplete = connectors.some((connector) => connector.id === storedConnectorId);
isComplete = aiConnectors.some((connector) => connector.id === storedConnectorId);
}
}
return { isComplete, metadata: { connectors, canExecuteConnectors, canCreateConnectors } };
return { isComplete, metadata: { connectors: aiConnectors, ...authz } };
};

5
x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/siem_migrations/ai_connector/types.ts
View file

@ -6,9 +6,8 @@
*/
import type { ActionConnector } from '@kbn/alerts-ui-shared';
import type { ConnectorsAuthz } from '../../common/connectors/authz';
export interface AIConnectorCardMetadata {
export interface AIConnectorCardMetadata extends ConnectorsAuthz {
connectors: ActionConnector[];
canExecuteConnectors: boolean;
canCreateConnectors: boolean;
}

1
x-pack/solutions/security/plugins/security_solution/tsconfig.json
View file

@ -239,5 +239,6 @@
"@kbn/product-doc-base-plugin",
"@kbn/shared-ux-error-boundary",
"@kbn/security-ai-prompts",
"@kbn/inference-endpoint-ui-common"
]
}