mirror of
https://github.com/elastic/kibana.git
synced 2025-04-21 00:13:52 -04:00
3f0fa7d245
## [Security Solution] [Elastic AI Assistant] Retrieval Augmented Generation (RAG) for Alerts This PR implements _Retrieval Augmented Generation_ (RAG) for Alerts in the Security Solution. This feature enables users to ask the assistant questions about the latest and riskiest open alerts in their environment using natural language, for example: - _How many alerts are currently open?_ - _Which alerts should I look at first?_ - _Did we have any alerts with suspicious activity on Windows machines?_ ### More context Previously, the assistant relied solely on the knowledge of the configured LLM and _singular_ alerts or events passed _by the client_ to the LLM as prompt context. This new feature: - Enables _multiple_ alerts to be passed by the _server_ as context to the LLM, via [LangChain tools](https://github.com/elastic/kibana/pull/167097) - Applies the user's [anonymization](https://github.com/elastic/kibana/pull/159857) settings to those alerts - Only fields allowed by the user will be sent as context to the LLM - Users may enable or disable anonymization for specific fields (via settings) - Click the conversation's `Show anonymized` toggle to see the anonymized values sent to / received from the LLM:  ### Settings This feature is enabled and configured via the `Knowledge Base` > `Alerts` settings in the screenshot below:  - The `Alerts` toggle enables or disables the feature - The slider has a range of `10` - `100` alerts (default: `20`) When the setting above is enabled, up to `n` alerts (as determined by the slider) that meet the following criteria will be returned: - the `kibana.alert.workflow_status` must be `open` - the alert must have been generated in the last `24 hours` - the alert must NOT be a `kibana.alert.building_block_type` alert - the `n` alerts are ordered by `kibana.alert.risk_score`, to prioritize the riskiest alerts ### Feature flag To use this feature: 1) Add the `assistantRagOnAlerts` feature flag to the `xpack.securitySolution.enableExperimental` setting in `config/kibana.yml` (or `config/kibana.dev.yml` in local development environments), per the example below: ``` xpack.securitySolution.enableExperimental: ['assistantRagOnAlerts'] ``` 2) Enable the `Alerts` toggle in the Assistant's `Knowledge Base` settings, per the screenshot below:  ## How it works - When the `Alerts` settings toggle is enabled, http `POST` requests to the `/internal/elastic_assistant/actions/connector/{id}/_execute` route include the following new (optional) parameters: - `alertsIndexPattern`, the alerts index for the current Kibana Space, e.g. `.alerts-security.alerts-default` - `allow`, the user's `Allowed` fields in the `Anonymization` settings, e.g. `["@timestamp", "cloud.availability_zone", "file.name", "user.name", ...]` - `allowReplacement`, the user's `Anonymized` fields in the `Anonymization` settings, e.g. `["cloud.availability_zone", "host.name", "user.name", ...]` - `replacements`, a `Record<string, string>` of replacements (generated on the server) that starts empty for a new conversation, and accumulates anonymized values until the conversation is cleared, e.g. ```json "replacements": { "e4f935c0-5a80-47b2-ac7f-816610790364": "Host-itk8qh4tjm", "cf61f946-d643-4b15-899f-6ffe3fd36097": "rpwmjvuuia", "7f80b092-fb1a-48a2-a634-3abc61b32157": "6astve9g6s", "f979c0d5-db1b-4506-b425-500821d00813": "Host-odqbow6tmc", // ... }, ``` - `size`, the numeric value set by the slider in the user's `Knowledge Base > Alerts` setting, e.g. `20` - The `postActionsConnectorExecuteRoute` function in `x-pack/plugins/elastic_assistant/server/routes/post_actions_connector_execute.ts` was updated to accept the new optional parameters, and to return an updated `replacements` with every response. (Every new request that is processed on the server may add additional anonymized values to the `replacements` returned in the response.) - The `callAgentExecutor` function in `x-pack/plugins/elastic_assistant/server/lib/langchain/execute_custom_llm_chain/index.ts` previously used a hard-coded array of LangChain tools that had just one entry, for the `ESQLKnowledgeBaseTool` tool. That hard-coded array was replaced in this PR with a call to the (new) `getApplicableTools` function: ```typescript const tools: Tool[] = getApplicableTools({ allow, allowReplacement, alertsIndexPattern, assistantLangChain, chain, esClient, modelExists, onNewReplacements, replacements, request, size, }); ``` - The `getApplicableTools` function in `x-pack/plugins/elastic_assistant/server/lib/langchain/tools/index.ts` examines the parameters in the `KibanaRequest` and only returns a filtered set of LangChain tools. If the request doesn't contain all the parameters required by a tool, it will NOT be returned by `getApplicableTools`. For example, if the required anonymization parameters are not included in the request, the `open-alerts` tool will not be returned. - The new `alert-counts` LangChain tool returned by the `getAlertCountsTool` function in `x-pack/plugins/elastic_assistant/server/lib/langchain/tools/alert_counts/get_alert_counts_tool.ts` provides the LLM the results of an aggregation on the last `24` hours of alerts (in the current Kibana Space), grouped by `kibana.alert.severity`. See the `getAlertsCountQuery` function in `x-pack/plugins/elastic_assistant/server/lib/langchain/tools/alert_counts/get_alert_counts_query.ts` for details - The new `open-alerts` LangChain tool returned by the `getOpenAlertsTool` function in `x-pack/plugins/elastic_assistant/server/lib/langchain/tools/open_alerts/get_open_alerts_tool.ts` provides the LLM up to `size` non-building-block alerts generated in the last `24` hours (in the current Kibana Space) with an `open` workflow status, ordered by `kibana.alert.risk_score` to prioritize the riskiest alerts. See the `getOpenAlertsQuery` function in `x-pack/plugins/elastic_assistant/server/lib/langchain/tools/open_alerts/get_open_alerts_query.ts` for details. - On the client, a conversation continues to accumulate additional `replacements` (and send them in subsequent requests) until the conversation is cleared - Anonymization functions that were only invoked by the browser were moved from the (browser) `kbn-elastic-assistant` package in `x-pack/packages/kbn-elastic-assistant/` to a new common package: `x-pack/packages/kbn-elastic-assistant-common` - The new `kbn-elastic-assistant-common` package is also consumed by the `elastic_assistant` (server) plugin: `x-pack/plugins/elastic_assistant`
113 lines
5.3 KiB
JSON
113 lines
5.3 KiB
JSON
{
|
|
"prefix": "xpack",
|
|
"paths": {
|
|
"xpack.actions": "plugins/actions",
|
|
"xpack.aiops": ["packages/ml/aiops_components", "plugins/aiops"],
|
|
"xpack.alerting": "plugins/alerting",
|
|
"xpack.eventLog": "plugins/event_log",
|
|
"xpack.stackAlerts": "plugins/stack_alerts",
|
|
"xpack.stackConnectors": "plugins/stack_connectors",
|
|
"xpack.apm": "plugins/apm",
|
|
"xpack.apmDataAccess": "plugins/apm_data_access",
|
|
"xpack.banners": "plugins/banners",
|
|
"xpack.canvas": "plugins/canvas",
|
|
"xpack.cases": "plugins/cases",
|
|
"xpack.cloud": "plugins/cloud",
|
|
"xpack.cloudChat": "plugins/cloud_integrations/cloud_chat",
|
|
"xpack.cloudDefend": "plugins/cloud_defend",
|
|
"xpack.cloudLinks": "plugins/cloud_integrations/cloud_links",
|
|
"xpack.cloudDataMigration": "plugins/cloud_integrations/cloud_data_migration",
|
|
"xpack.csp": "plugins/cloud_security_posture",
|
|
"xpack.customBranding": "plugins/custom_branding",
|
|
"xpack.dashboard": "plugins/dashboard_enhanced",
|
|
"xpack.datasetQuality": "plugins/dataset_quality",
|
|
"xpack.discover": "plugins/discover_enhanced",
|
|
"xpack.crossClusterReplication": "plugins/cross_cluster_replication",
|
|
"xpack.elasticAssistant": "packages/kbn-elastic-assistant",
|
|
"xpack.elasticAssistantCommon": "packages/kbn-elastic-assistant-common",
|
|
"xpack.ecsDataQualityDashboard": "plugins/ecs_data_quality_dashboard",
|
|
"xpack.embeddableEnhanced": "plugins/embeddable_enhanced",
|
|
"xpack.endpoint": "plugins/endpoint",
|
|
"xpack.enterpriseSearch": "plugins/enterprise_search",
|
|
"xpack.features": "plugins/features",
|
|
"xpack.dataVisualizer": "plugins/data_visualizer",
|
|
"xpack.exploratoryView": "plugins/exploratory_view",
|
|
"xpack.fileUpload": "plugins/file_upload",
|
|
"xpack.globalSearch": ["plugins/global_search"],
|
|
"xpack.globalSearchBar": ["plugins/global_search_bar"],
|
|
"xpack.graph": ["plugins/graph"],
|
|
"xpack.grokDebugger": "plugins/grokdebugger",
|
|
"xpack.idxMgmt": "plugins/index_management",
|
|
"xpack.indexLifecycleMgmt": "plugins/index_lifecycle_management",
|
|
"xpack.infra": "plugins/infra",
|
|
"xpack.logExplorer": "plugins/log_explorer",
|
|
"xpack.logsShared": "plugins/logs_shared",
|
|
"xpack.fleet": "plugins/fleet",
|
|
"xpack.ingestPipelines": "plugins/ingest_pipelines",
|
|
"xpack.kubernetesSecurity": "plugins/kubernetes_security",
|
|
"xpack.lens": "plugins/lens",
|
|
"xpack.licenseApiGuard": "plugins/license_api_guard",
|
|
"xpack.licenseMgmt": "plugins/license_management",
|
|
"xpack.licensing": "plugins/licensing",
|
|
"xpack.lists": "plugins/lists",
|
|
"xpack.logstash": ["plugins/logstash"],
|
|
"xpack.main": "legacy/plugins/xpack_main",
|
|
"xpack.maps": ["plugins/maps"],
|
|
"xpack.metricsData": "plugins/metrics_data_access",
|
|
"xpack.ml": [
|
|
"packages/ml/anomaly_utils",
|
|
"packages/ml/creation_wizard_utils",
|
|
"packages/ml/data_grid",
|
|
"packages/ml/data_view_utils",
|
|
"packages/ml/date_picker",
|
|
"packages/ml/trained_models_utils",
|
|
"packages/ml/category_validator",
|
|
"packages/ml/ui_actions",
|
|
"plugins/ml"
|
|
],
|
|
"xpack.monitoring": ["plugins/monitoring"],
|
|
"xpack.observability": "plugins/observability",
|
|
"xpack.observabilityLogExplorer": "plugins/observability_log_explorer",
|
|
"xpack.observabilityShared": "plugins/observability_shared",
|
|
"xpack.observability_onboarding": "plugins/observability_onboarding",
|
|
"xpack.observabilityAiAssistant": "plugins/observability_ai_assistant",
|
|
"xpack.osquery": ["plugins/osquery"],
|
|
"xpack.painlessLab": "plugins/painless_lab",
|
|
"xpack.profiling": ["plugins/profiling"],
|
|
"xpack.remoteClusters": "plugins/remote_clusters",
|
|
"xpack.reporting": ["plugins/reporting"],
|
|
"xpack.rollupJobs": ["plugins/rollup"],
|
|
"xpack.runtimeFields": "plugins/runtime_fields",
|
|
"xpack.screenshotting": "plugins/screenshotting",
|
|
"xpack.searchProfiler": "plugins/searchprofiler",
|
|
"xpack.security": "plugins/security",
|
|
"xpack.server": "legacy/server",
|
|
"xpack.serverless": "plugins/serverless",
|
|
"xpack.serverlessSearch": "plugins/serverless_search",
|
|
"xpack.serverlessObservability": "plugins/serverless_observability",
|
|
"xpack.securitySolution": "plugins/security_solution",
|
|
"xpack.securitySolutionEss": "plugins/security_solution_ess",
|
|
"xpack.securitySolutionServerless": "plugins/security_solution_serverless",
|
|
"xpack.sessionView": "plugins/session_view",
|
|
"xpack.snapshotRestore": "plugins/snapshot_restore",
|
|
"xpack.spaces": "plugins/spaces",
|
|
"xpack.savedObjectsTagging": ["plugins/saved_objects_tagging"],
|
|
"xpack.taskManager": "legacy/plugins/task_manager",
|
|
"xpack.threatIntelligence": "plugins/threat_intelligence",
|
|
"xpack.timelines": "plugins/timelines",
|
|
"xpack.transform": "plugins/transform",
|
|
"xpack.triggersActionsUI": "plugins/triggers_actions_ui",
|
|
"xpack.upgradeAssistant": "plugins/upgrade_assistant",
|
|
"xpack.synthetics": ["plugins/synthetics"],
|
|
"xpack.ux": ["plugins/ux"],
|
|
"xpack.uptime": ["plugins/uptime"],
|
|
"xpack.urlDrilldown": "plugins/drilldowns/url_drilldown",
|
|
"xpack.watcher": "plugins/watcher"
|
|
},
|
|
"exclude": ["examples"],
|
|
"translations": [
|
|
"@kbn/translations-plugin/translations/zh-CN.json",
|
|
"@kbn/translations-plugin/translations/ja-JP.json",
|
|
"@kbn/translations-plugin/translations/fr-FR.json"
|
|
]
|
|
}
|