[Security Solution] Onboarding check inference endpoint

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_card.tsx

@@ -117,6 +117,10 @@ export const AssistantCard: OnboardingCardComponent<AssistantCardMetadata> = ({
             provider: apiProvider,
             model,
           },
+        }).catch(() => {
+          // If the conversation is not found, it means the connector was deleted
+          // and return null to avoid setting the conversation
+          return null;
         });
 
         if (conversation && onConversationChange != null) {

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_check_complete.ts

@@ -5,43 +5,32 @@
  * 2.0.
  */
 
-import { loadAllActions as loadConnectors } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
-import type { AIConnector } from '@kbn/elastic-assistant/impl/connectorland/connector_selector';
 import { i18n } from '@kbn/i18n';
 import type { OnboardingCardCheckComplete } from '../../../../types';
-import { AIActionTypeIds } from '../common/connectors/constants';
+import { loadAiConnectors } from '../common/connectors/ai_connectors';
+import { getConnectorsAuthz } from '../common/connectors/authz';
 import type { AssistantCardMetadata } from './types';
 
+const completeBadgeText = (count: number) =>
+  i18n.translate('xpack.securitySolution.onboarding.assistantCard.badge.completeText', {
+    defaultMessage: '{count} AI {count, plural, one {connector} other {connectors}} added',
+    values: { count },
+  });
+
 export const checkAssistantCardComplete: OnboardingCardCheckComplete<
   AssistantCardMetadata
 > = async ({ http, application }) => {
-  const allConnectors = await loadConnectors({ http });
-  const {
-    capabilities: { actions },
-  } = application;
+  const authz = getConnectorsAuthz(application.capabilities);
 
-  const aiConnectors = allConnectors.reduce((acc: AIConnector[], connector) => {
-    if (!connector.isMissingSecrets && AIActionTypeIds.includes(connector.actionTypeId)) {
-      acc.push(connector);
-    }
-    return acc;
-  }, []);
+  if (!authz.canReadConnectors) {
+    return { isComplete: false, metadata: { connectors: [], ...authz } };
+  }
 
-  const completeBadgeText = i18n.translate(
-    'xpack.securitySolution.onboarding.assistantCard.badge.completeText',
-    {
-      defaultMessage: '{count} AI {count, plural, one {connector} other {connectors}} added',
-      values: { count: aiConnectors.length },
-    }
-  );
+  const aiConnectors = await loadAiConnectors(http);
 
   return {
     isComplete: aiConnectors.length > 0,
-    completeBadgeText,
-    metadata: {
-      connectors: aiConnectors,
-      canExecuteConnectors: Boolean(actions?.show && actions?.execute),
-      canCreateConnectors: Boolean(actions?.save),
-    },
+    completeBadgeText: completeBadgeText(aiConnectors.length),
+    metadata: { connectors: aiConnectors, ...authz },
   };
 };

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/translations.ts

@@ -18,7 +18,7 @@ export const ASSISTANT_CARD_DESCRIPTION = i18n.translate(
   'xpack.securitySolution.onboarding.assistantCard.description',
   {
     defaultMessage:
-      'The Elastic AI connector is currently configured, powered by OpenAI gpt 4.0 for optimal performance for migrating SIEM rules. However,any AI service provider can be configured. Read more about AI provider performance and other Elastic powered by AI features.',
+      'Choose and configure any AI provider available to use with Elastic AI Assistant.',
   }
 );
 

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/types.ts

@@ -6,9 +6,8 @@
  */
 
 import type { ActionConnector } from '@kbn/alerts-ui-shared';
+import type { ConnectorsAuthz } from '../common/connectors/authz';
 
-export interface AssistantCardMetadata {
+export interface AssistantCardMetadata extends ConnectorsAuthz {
   connectors: ActionConnector[];
-  canExecuteConnectors: boolean;
-  canCreateConnectors: boolean;
 }

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/ai_connectors.test.ts

@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { loadAiConnectors } from './ai_connectors';
+import { loadAllActions } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
+import { isInferenceEndpointExists } from '@kbn/inference-endpoint-ui-common';
+import type { HttpSetup } from '@kbn/core-http-browser';
+import type { ActionConnector } from '@kbn/triggers-actions-ui-plugin/public/common/constants';
+
+jest.mock('@kbn/triggers-actions-ui-plugin/public/common/constants', () => ({
+  loadAllActions: jest.fn(),
+}));
+
+jest.mock('@kbn/inference-endpoint-ui-common', () => ({
+  isInferenceEndpointExists: jest.fn(),
+}));
+
+const mockHttp = {} as HttpSetup;
+const mockLoadAllActions = loadAllActions as jest.Mock;
+const mockIsInferenceEndpointExists = isInferenceEndpointExists as jest.Mock;
+
+describe('loadAiConnectors', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should return only valid external AI connectors', async () => {
+    const mockConnectors: ActionConnector[] = [
+      { id: '1', actionTypeId: '.gen-ai', isMissingSecrets: false } as ActionConnector,
+      { id: '2', actionTypeId: '.gen-ai', isMissingSecrets: true } as ActionConnector,
+      { id: '3', actionTypeId: '.webhook', isMissingSecrets: false } as ActionConnector,
+    ];
+
+    mockLoadAllActions.mockResolvedValue(mockConnectors);
+
+    const result = await loadAiConnectors(mockHttp);
+
+    expect(result).toEqual([{ id: '1', actionTypeId: '.gen-ai', isMissingSecrets: false }]);
+  });
+
+  it('should include valid preconfigured inference connectors with existing endpoint', async () => {
+    const mockConnectors: ActionConnector[] = [
+      {
+        id: '1',
+        actionTypeId: '.inference',
+        isMissingSecrets: false,
+        isPreconfigured: true,
+        config: { inferenceId: 'my-inference' },
+      } as unknown as ActionConnector,
+    ];
+
+    mockLoadAllActions.mockResolvedValue(mockConnectors);
+    mockIsInferenceEndpointExists.mockResolvedValue(true);
+
+    const result = await loadAiConnectors(mockHttp);
+
+    expect(mockIsInferenceEndpointExists).toHaveBeenCalledWith(mockHttp, 'my-inference');
+    expect(result).toEqual(mockConnectors);
+  });
+
+  it('should exclude inference connectors if endpoint does not exist', async () => {
+    const mockConnectors: ActionConnector[] = [
+      {
+        id: '1',
+        actionTypeId: '.inference',
+        isMissingSecrets: false,
+        isPreconfigured: true,
+        config: { inferenceId: 'missing' },
+      } as unknown as ActionConnector,
+    ];
+
+    mockLoadAllActions.mockResolvedValue(mockConnectors);
+    mockIsInferenceEndpointExists.mockResolvedValue(false);
+
+    const result = await loadAiConnectors(mockHttp);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should exclude inference connectors if it is not configured correctly', async () => {
+    const mockConnectors: ActionConnector[] = [
+      {
+        id: '1',
+        actionTypeId: '.inference',
+        isMissingSecrets: false,
+        isPreconfigured: true,
+        config: { inferenceId: undefined },
+      } as unknown as ActionConnector,
+    ];
+
+    mockLoadAllActions.mockResolvedValue(mockConnectors);
+    mockIsInferenceEndpointExists.mockResolvedValue(true);
+
+    const result = await loadAiConnectors(mockHttp);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should exclude connectors with missing secrets', async () => {
+    const mockConnectors: ActionConnector[] = [
+      { id: '1', actionTypeId: '.bedrock', isMissingSecrets: true } as ActionConnector,
+    ];
+
+    mockLoadAllActions.mockResolvedValue(mockConnectors);
+
+    const result = await loadAiConnectors(mockHttp);
+
+    expect(result).toEqual([]);
+  });
+
+  it('should return an empty array if no connectors are valid', async () => {
+    const mockConnectors: ActionConnector[] = [
+      { id: '1', actionTypeId: '.webhook', isMissingSecrets: false } as ActionConnector,
+    ];
+
+    mockLoadAllActions.mockResolvedValue(mockConnectors);
+
+    const result = await loadAiConnectors(mockHttp);
+
+    expect(result).toEqual([]);
+  });
+});

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/ai_connectors.ts

@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { HttpSetup } from '@kbn/core-http-browser';
+import { isInferenceEndpointExists } from '@kbn/inference-endpoint-ui-common';
+import {
+  loadAllActions,
+  type ActionConnector,
+} from '@kbn/triggers-actions-ui-plugin/public/common/constants';
+
+const AllowedActionTypeIds = ['.bedrock', '.gen-ai', '.gemini', '.inference'];
+
+type PreConfiguredInferenceConnector = ActionConnector & {
+  actionTypeId: '.inference';
+  isPreconfigured: true;
+  config?: {
+    inferenceId?: string;
+  };
+};
+
+const isAllowedConnector = (connector: ActionConnector): boolean =>
+  AllowedActionTypeIds.includes(connector.actionTypeId);
+
+const isPreConfiguredInferenceConnector = (
+  connector: ActionConnector
+): connector is PreConfiguredInferenceConnector =>
+  connector.actionTypeId === '.inference' && connector.isPreconfigured;
+
+const isValidAiConnector = async (
+  connector: ActionConnector,
+  deps: { http: HttpSetup }
+): Promise<boolean> => {
+  if (connector.isMissingSecrets) {
+    return false;
+  }
+
+  if (!isAllowedConnector(connector)) {
+    return false;
+  }
+
+  if (isPreConfiguredInferenceConnector(connector)) {
+    const inferenceId = connector.config?.inferenceId;
+    if (!inferenceId) {
+      return false;
+    }
+    const exists = await isInferenceEndpointExists(deps.http, inferenceId);
+    if (!exists) {
+      return false;
+    }
+  }
+
+  return true;
+};
+
+/**
+ * Loads all AI connectors that are valid, meaning that they don't miss secrets.
+ * And in the case of the inference connector, that the inference endpoint exists.
+ * @param http - The HTTP client to use for making requests.
+ * @returns A promise that resolves to an array of valid AI connectors.
+ */
+export const loadAiConnectors = async (http: HttpSetup) => {
+  const allConnectors = await loadAllActions({ http });
+
+  const aiConnectors: ActionConnector[] = [];
+  for (const connector of allConnectors) {
+    const isValid = await isValidAiConnector(connector, { http });
+    if (isValid) {
+      aiConnectors.push(connector);
+    }
+  }
+  return aiConnectors;
+};

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/authz.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Capabilities } from '@kbn/core/public';
+import { CapabilitiesChecker } from '../../../../../../common/lib/capabilities';
+
+export interface ConnectorsAuthz {
+  canReadConnectors: boolean;
+  canExecuteConnectors: boolean;
+  canCreateConnectors: boolean;
+}
+
+export const getConnectorsAuthz = (capabilities: Capabilities): ConnectorsAuthz => {
+  const checker = new CapabilitiesChecker(capabilities);
+  return {
+    canReadConnectors: checker.has('actions.show'),
+    canExecuteConnectors: checker.has([['actions.show', 'actions.execute']]),
+    canCreateConnectors: checker.has('actions.save'),
+  };
+};

x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/common/connectors/connector_cards.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useMemo } from 'react';
+import React, { useCallback } from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
 import { css } from '@emotion/react';
 import { useLoadActionTypes } from '@kbn/elastic-assistant/impl/connectorland/use_load_action_types';
@@ -14,7 +14,6 @@ import { ConnectorsMissingPrivilegesCallOut } from './missing_privileges';
 import type { AIConnector } from './types';
 import { ConnectorSetup } from './connector_setup';
 import { ConnectorSelectorPanel } from './connector_selector_panel';
-import { AIActionTypeIds } from './constants';
 
 interface ConnectorCardsProps {
   onNewConnectorSaved: (connectorId: string) => void;
@@ -33,11 +32,7 @@ export const ConnectorCards = React.memo<ConnectorCardsProps>(
     onConnectorSelected,
   }) => {
     const { http, notifications } = useKibana().services;
-    const { data } = useLoadActionTypes({ http, toasts: notifications.toasts });
-    const actionTypes = useMemo(
-      () => data?.filter(({ id }) => AIActionTypeIds.includes(id)),
-      [data]
-    );
+    const { data: actionTypes } = useLoadActionTypes({ http, toasts: notifications.toasts });
 
     const onNewConnectorStoredSave = useCallback(
       (newConnector: AIConnector) => {