kibana/x-pack
Kenneth Kreindler e176c84449
[Security Solution] [AI Assistant] Fix flashing citations (#209629)
## Summary

Fixes a small UI bug in the citations feature. Previously, after a
message with citations finished streaming, the citations would disappear
for a fraction of a second and then reappear again. This PR makes
improves the UI by making the citations not flash off and on after the
stream finishes.

### Changes:
- Fix flashing citations
- Refactor code related to parsing content references (to make it more
maintainable).
- Update the citations prompt slightly.

### Before:


https://github.com/user-attachments/assets/1021dd53-018a-43ba-b1f4-24aab44faca9

<img width="1782" alt="image"
src="https://github.com/user-attachments/assets/723cd29a-48a2-48e7-b031-0893484746b9"
/>


### After:


https://github.com/user-attachments/assets/21f340bc-9015-42b6-a574-0439d2f8f192

### How to test
- Enable the feature flag
```yaml
# kibana.dev.yml
xpack.securitySolution.enableExperimental: ['contentReferencesEnabled']
```
- Open the security assistant
- Ask it a question about your alerts of a document in your KB. The
response should contain citations.
- Observe the response stream carefully. Ensure the citations e.g. `[1]`
do not flash off and on when the response stream finishes. The expected
behavior is that while the message is streaming, the citations are
disabled and once the stream finishes the citations get enabled (while
always being visible).

#### Edge case to test
It is possible that citations completely disappear after streaming
finishes. This happens when the LLM produces an invalid citation.
Invalid citations are hidden client side when a message finishes
streaming. You can verify this behavior by asking GPT4o this question:
```
Prepend each line with this placeholder citation "{reference(1234)}" and append the actual citation at the end of the line. How many alerts do I have? Use the open and acknowledged alerts count tool to answer and repeat the answer 50 times on new lines.
```

While the response is getting streamed it should look like this:

<img width="200" alt="image"
src="https://github.com/user-attachments/assets/03d160bf-2404-4a4e-8701-e3183c604cc4"
/>

And when the stream finishes it should look like this:

<img width="200" alt="image"
src="https://github.com/user-attachments/assets/06367379-17da-438f-a93a-9d539067ab90"
/>


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [X]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [X] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [X] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [X] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [X] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2025-02-13 15:07:25 +00:00
..
build_chromium Sustainable Kibana Architecture: Move plugins owned by @elastic/appex-sharedux (#204959) 2025-01-03 05:38:57 -06:00
dev-tools SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00
examples [ResponseOps][Alerts] Move the alerts table to a dedicated package (#207878) 2025-02-12 11:07:55 +01:00
packages [Fleet] Fix elastic-agent docker image path (#210008) 2025-02-11 22:04:03 +01:00
performance
platform [Security Solution] [AI Assistant] Fix flashing citations (#209629) 2025-02-13 15:07:25 +00:00
scripts
solutions [Security Solution] [AI Assistant] Fix flashing citations (#209629) 2025-02-13 15:07:25 +00:00
test [Rules migration][Integration test] Get migration rules API (#11232) (#210867) 2025-02-13 13:44:08 +01:00
test_serverless [kbn-scout] add test config category to reporting (#210167) 2025-02-12 11:17:04 +01:00
.gitignore Sustainable Kibana Architecture: Move plugins owned by @elastic/appex-sharedux (#204959) 2025-01-03 05:38:57 -06:00
.i18nrc.json [OneDiscover] Remove logs explorer (#209565) 2025-02-06 17:40:55 +00:00
.telemetryrc.json [Core] [Telemetry] Update file references (#205603) 2025-01-06 15:46:46 +01:00
package.json chore(NA): bump version to 9.1.0 (#208990) 2025-01-31 06:05:13 +00:00
README.md SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00

Elastic License Functionality

This directory tree contains files subject to the Elastic License 2.0. The files subject to the Elastic License 2.0 are grouped in this directory to clearly separate them from files licensed otherwise.

Alert Details page feature flags (feature-flag-per-App)

If you have:

xpack.observability.unsafe.alertDetails.uptime.enabled: true

[For Uptime rule type] In Kibana configuration, will allow the user to navigate to the new Alert Details page, instead of the Alert Flyout when clicking on View alert details in the Alert table

Development

By default, Kibana will run with X-Pack installed as mentioned in the contributing guide.

Elasticsearch will run with a basic license. To run with a trial license, including security, you can specifying that with the yarn es command.

Example: yarn es snapshot --license trial --password changeme

By default, this will also set the password for native realm accounts to the password provided (changeme by default). This includes that of the kibana_system user which elasticsearch.username defaults to in development. If you wish to specify a password for a given native realm account, you can do that like so: --password.kibana_system=notsecure

Testing

For information on testing, see the Elastic functional test development guide.

Running functional tests

The functional UI tests, the API integration tests, and the SAML API integration tests are all run against a live browser, Kibana, and Elasticsearch install. Each set of tests is specified with a unique config that describes how to start the Elasticsearch server, the Kibana server, and what tests to run against them. The sets of tests that exist today are functional UI tests (specified by this config), API integration tests (specified by this config), and SAML API integration tests (specified by this config).

The script runs all sets of tests sequentially like so:

  • builds Elasticsearch and X-Pack
  • runs Elasticsearch with X-Pack
  • starts up the Kibana server with X-Pack
  • runs the functional UI tests against those servers
  • tears down the servers
  • repeats the same process for the API and SAML API integration test configs.

To do all of this in a single command run:

node scripts/functional_tests

Developing functional UI tests

If you are developing functional tests then you probably don't want to rebuild Elasticsearch and wait for all that setup on every test run, so instead use this command to build and start just the Elasticsearch and Kibana servers:

node scripts/functional_tests_server

After the servers are started, open a new terminal and run this command to run just the tests (without tearing down Elasticsearch or Kibana):

node scripts/functional_test_runner

For both of the above commands, it's crucial that you pass in --config to specify the same config file to both commands. This makes sure that the right tests will run against the right servers. Typically a set of tests and server configuration go together.

Read more about how the scripts work here.

For a deeper dive, read more about the way functional tests and servers work here.

Running API integration tests

API integration tests are run with a unique setup usually without UI assets built for the Kibana server.

API integration tests are intended to test only programmatic API exposed by Kibana. There is no need to run browser and simulate user actions, which significantly reduces execution time. In addition, the configuration for API integration tests typically sets optimize.enabled=false for Kibana because UI assets are usually not needed for these tests.

To run only the API integration tests:

node scripts/functional_tests --config test/api_integration/config

Running SAML API integration tests

We also have SAML API integration tests which set up Elasticsearch and Kibana with SAML support. Run only API integration tests with SAML enabled like so:

node scripts/functional_tests --config test/security_api_integration/saml.config

Running Jest integration tests

Jest integration tests can be used to test behavior with Elasticsearch and the Kibana server.

yarn test:jest_integration

Running Reporting functional tests

See here for more information on running reporting tests.

Running Security Solution Cypress E2E/integration tests

See here for information on running this test suite.