[AI4DSOC] Alert summary table and flyout ai assistant by PhilippeOberti · Pull Request #217744 · elastic/kibana

PhilippeOberti · 2025-04-09T19:30:18Z

Summary

This PR builds up on the previous #216744 and the AI assistant in 2 places in the AI for SOC alert summary page:

in each row of the alert table as a row action
in the footer of the alert details flyout

Screen.Recording.2025-04-15.at.11.39.45.PM.mov

To keep consistency between the alert summary and the alerts page, this PR also removes the Chat icon button in the header of the alert details flyout and adds a Ask AI Assistant button in the footer.

Before	After

How to test

This needs to be ran in Serverless:

yarn es serverless --projectType security
yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Use one of these Serverless users:

platform_engineer
endpoint_operations_analyst
endpoint_policy_manager
admin
system_indices_superuser

Then:

generate data: yarn test:generate:serverless-dev
create 4 catch all rules, each with a name of a AI for SOC integration (google_secops, microsoft_sentinel,, sentinel_one and crowdstrike)
change this line to installedPackages: availablePackages to force having some packages installed
change this line to r.name === p.name to make sure there will be matches between integrations and rules

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

https://github.com/elastic/security-team/issues/11973

elasticmachine · 2025-04-16T05:23:27Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/new_chat_by_title/index.tsx

janmonschke · 2025-04-17T08:24:43Z

...ns/security/plugins/security_solution/public/detections/hooks/alert_summary/use_assistant.ts

+    // remove all fields that start with signal. as these are legacy fields
+    for (const key in cleanedAlert) {
+      if (key.startsWith('signal.')) {
+        delete cleanedAlert[key];
+      }
+    }


This looks like something we might want to do on the assistant's side of things rather than in security solution. Wdyt?

Well, removing these fields before flattening the Alert object makes the flattening go faster, so doing it on the assistant side would be a bit less efficient?

Sure, I just think that maybe the assistant should flatten and remove keys that it does not care about. Since the assistant is used all over the place, there might be many places that do exactly this kind of cleanup. But it's not a blocker for this PR of course :)

True... I can chat with them. We'd have to do this in other places as we have similar logic being applied in the alerts page alert flyout, but starting from a different type of object

...ns/security/plugins/security_solution/public/detections/hooks/alert_summary/use_assistant.ts

elasticmachine · 2025-04-17T20:37:09Z

💚 Build Succeeded

Buildkite Build
Commit: 35e0e3d

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	7217	7221	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.0MB	9.0MB	+2.4KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`@kbn/elastic-assistant`	11	12	+1

History

💚 Build #294228 succeeded 5539543
💛 Build #293763 was flaky 1524b23
💔 Build #293527 failed 8b08382

PhilippeOberti · 2025-04-18T00:11:58Z

run docs-build

## Summary This PR builds up on the previous elastic#216744 and the AI assistant in 2 places in the AI for SOC alert summary page: - in each row of the alert table as a row action - in the footer of the alert details flyout https://github.com/user-attachments/assets/65fb10f1-c22b-4796-9109-3b7dbdba6313 To keep consistency between the alert summary and the alerts page, this PR also removes the Chat icon button in the header of the alert details flyout and adds a `Ask AI Assistant` button in the footer. | Before | After | | ------------- | ------------- | | ![Screenshot 2025-04-15 at 11 54 36 PM](https://github.com/user-attachments/assets/b6039081-d5b8-4bf7-ada1-af3844e17bad) | ![Screenshot 2025-04-15 at 11 54 09 PM](https://github.com/user-attachments/assets/6833a89c-931e-4eb3-be93-4fc1e2ed96e2) | ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` Then: - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11973

## Summary This PR builds up on the previous elastic#216744 and the AI assistant in 2 places in the AI for SOC alert summary page: - in each row of the alert table as a row action - in the footer of the alert details flyout https://github.com/user-attachments/assets/65fb10f1-c22b-4796-9109-3b7dbdba6313 To keep consistency between the alert summary and the alerts page, this PR also removes the Chat icon button in the header of the alert details flyout and adds a `Ask AI Assistant` button in the footer. | Before | After | | ------------- | ------------- | | ![Screenshot 2025-04-15 at 11 54 36 PM](https://github.com/user-attachments/assets/b6039081-d5b8-4bf7-ada1-af3844e17bad) | ![Screenshot 2025-04-15 at 11 54 09 PM](https://github.com/user-attachments/assets/6833a89c-931e-4eb3-be93-4fc1e2ed96e2) | ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` Then: - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11973 (cherry picked from commit add6e30)

…) (#222074) # Backport This will backport the following commits from `main` to `8.19`: - [[AI4DSOC] Alert summary page routing and initialization (#214889)](#214889) - [[AI4DSOC] Alert summary landing page (#215246)](#215246) - [[AI4DSOC] Alert summary dataview (#215265)](#215265) - [[AI4DSOC] Alert summary KQL bar [#215586]](#215586) - [[AI4DSOC] Alert summary KPI charts [#215585]](#215585) - [[AI4DSOR] Alert summary integrations section [#215266]](#215266) - [[AI4DSOC] Fix issue with filtering by integrations [#216574]](#216574) - [[AI4DSOC] Alert summary table setup [#216744]](#216744) - [Alerty summary table flyout setup [#217421]](#217421) - [[AI4DSOC] Alert summary alert actions in table and flyout [#217696]](#217696) - [[AI4DSOC] Alert summary table custom cell renderers [#217124]](#217124) - [[AI4DSOC] Alert summary table and flyout ai assistant [#217744]](#217744) - [[AI4DSOC] Alert summary page performance improvements [#218632]](#218632) - [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC alerts table [#218736]](#218736) - [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table [#218742]](#218742) - [[AI4DSOC] Fix spacing issue on alert summary landing page integration card [#218868]](#218868) - [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined maintenanceWindow capability [#218999]](#218999) - [[AI4DSOC] Fix link to the new integrations page [#219030]](#219030) - [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack discovery page [#219033]](#219033) - [[AI4DSOC] Add cell renderer for datetime fields to the alert summary table [#219126]](#219126) - [[AI4DSOC] Remove Assistant icon from row action in alert summary table [#219141]](#219141) - [[AI4DSOC] Add checkboxes to the alert summary table [#219169]](#219169) - [[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC [#219410]](#219410) - [[AI4DSOC] Fix logic that renders the group title when grouping by integrations [#219430]](#219430) - [[AI4DSOC] Alert summary table truncates long values and display the field/value pair in tooltip [#219438]](#219438) - [[Security Solution] Fix alerts table potentially not applying alert assignees [#219460]](#219460) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

PhilippeOberti force-pushed the alerty-summary-table-ai-assistant branch 7 times, most recently from 953c33f to 8b08382 Compare April 16, 2025 05:22

elastic deleted a comment from elasticmachine Apr 16, 2025

PhilippeOberti marked this pull request as ready for review April 16, 2025 05:23

PhilippeOberti requested review from a team as code owners April 16, 2025 05:23

PhilippeOberti force-pushed the alerty-summary-table-ai-assistant branch from 8b08382 to 1524b23 Compare April 16, 2025 13:31

janmonschke reviewed Apr 17, 2025

View reviewed changes

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/new_chat_by_title/index.tsx Outdated Show resolved Hide resolved

janmonschke reviewed Apr 17, 2025

View reviewed changes

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/new_chat_by_title/index.tsx Outdated Show resolved Hide resolved

lgestc approved these changes Apr 17, 2025

View reviewed changes

janmonschke reviewed Apr 17, 2025

View reviewed changes

...ns/security/plugins/security_solution/public/detections/hooks/alert_summary/use_assistant.ts Show resolved Hide resolved

janmonschke reviewed Apr 17, 2025

View reviewed changes

...ns/security/plugins/security_solution/public/detections/hooks/alert_summary/use_assistant.ts Show resolved Hide resolved

PhilippeOberti force-pushed the alerty-summary-table-ai-assistant branch from 1524b23 to 5539543 Compare April 17, 2025 16:07

janmonschke approved these changes Apr 17, 2025

View reviewed changes

PhilippeOberti added 2 commits April 17, 2025 13:34

[AI4DSOC] Alert summary AI Assistant action in table and flyout

f37ee85

PR comments

35e0e3d

PhilippeOberti force-pushed the alerty-summary-table-ai-assistant branch from 5539543 to 35e0e3d Compare April 17, 2025 18:51

andrew-goldstein approved these changes Apr 17, 2025

View reviewed changes

PhilippeOberti enabled auto-merge (squash) April 17, 2025 20:26

PhilippeOberti disabled auto-merge April 17, 2025 20:37

PhilippeOberti enabled auto-merge (squash) April 17, 2025 20:38

PhilippeOberti merged commit add6e30 into elastic:main Apr 18, 2025
9 checks passed

PhilippeOberti deleted the alerty-summary-table-ai-assistant branch April 18, 2025 00:40

stephmilovic mentioned this pull request Apr 28, 2025

[AI4DSOC] Move AI4DSOC components from kbn-elastic-assistant to security_solution #219288

Merged

PhilippeOberti mentioned this pull request May 30, 2025

[8.19] [AI4DSOC] Backport of AI4DSOC alert summary related PRs (#214889) #222074

Merged

PhilippeOberti added the v8.19.0 label Jun 4, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[AI4DSOC] Alert summary table and flyout ai assistant#217744

[AI4DSOC] Alert summary table and flyout ai assistant#217744
PhilippeOberti merged 2 commits intoelastic:mainfrom
PhilippeOberti:alerty-summary-table-ai-assistant

PhilippeOberti commented Apr 9, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Apr 16, 2025

Uh oh!

Uh oh!

Uh oh!

janmonschke Apr 17, 2025

Uh oh!

PhilippeOberti Apr 17, 2025

Uh oh!

janmonschke Apr 17, 2025

Uh oh!

PhilippeOberti Apr 17, 2025

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Apr 17, 2025

Uh oh!

PhilippeOberti commented Apr 18, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

PhilippeOberti commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to test

Checklist

Uh oh!

elasticmachine commented Apr 16, 2025

Uh oh!

Uh oh!

Uh oh!

janmonschke Apr 17, 2025

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Apr 17, 2025

Choose a reason for hiding this comment

Uh oh!

janmonschke Apr 17, 2025

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Apr 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Apr 17, 2025

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Public APIs missing exports

History

Uh oh!

PhilippeOberti commented Apr 18, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

PhilippeOberti commented Apr 9, 2025 •

edited

Loading