Skip to content

[Security Assistant] Starter prompts#224981

Merged
stephmilovic merged 58 commits intoelastic:mainfrom
stephmilovic:tile_prompts
Jun 25, 2025
Merged

[Security Assistant] Starter prompts#224981
stephmilovic merged 58 commits intoelastic:mainfrom
stephmilovic:tile_prompts

Conversation

@stephmilovic
Copy link
Contributor

@stephmilovic stephmilovic commented Jun 24, 2025

Summary

Behind feature flag:

feature_flags.overrides:
  elasticAssistant.starterPromptsEnabled: true

Adds new starter prompts to the AI Assistant EmptyConvo page
Screenshot 2025-06-23 at 6 01 47 PM

The prompts are Security AI Prompts integration, and are included in this PR: elastic/integrations#14296

SecurityLabsTool change

As one of these prompts attempts to invoke security labs, I've added a conditional tool response that advises the user to install the knowledge base if this prompt is used when the KB does not exist. See how that works in this trace: https://smith.langchain.com/public/60d222bc-c49d-4245-a189-898b901c8c3b/r

@stephmilovic stephmilovic added release_note:enhancement Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v9.1.0 v8.19.0 labels Jun 24, 2025
@stephmilovic stephmilovic changed the title Tile prompts [Security Assistant] Starter prompts Jun 24, 2025
@stephmilovic stephmilovic requested review from a team as code owners June 25, 2025 03:11
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@stephmilovic stephmilovic removed the request for review from a team June 25, 2025 03:14
Comment on lines +56 to +62
if (docs.length === 0) {
const isKnowledgeBaseInstalled = await getIsKnowledgeBaseInstalled(kbDataClient);
if (!isKnowledgeBaseInstalled) {
// prompt to help user install knowledge base
return 'The "AI Assistant knowledge base" needs to be installed, containing the Security Labs content. Navigate to the Knowledge Base page in the AI Assistant Settings to install it.';
}
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: this could happen before the actual KB search above, no?

This was functionally equivalent when testing so no biggie either way. I am curious why the tool is even being registered though, as we have the KB requirement specified above in isSupported(). I think that might need to be updated (for all tools) as it just checks for a not null kbDataClient, which I believe will always be not null as the client is available even if the KB isn't set up.

No change necessary here as it behaves as expected, more of a note for a future fix/update to isSupported().

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems product's preference is to have the tool registered even when KB is not installed in order to inform user to install it. yes it could happen above the kb search, put it below so we're not doing an extra call every time

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I concur with this flow as well 👍. Either way, I think we'll need to update isSupported for all the tools later since that old check on the kbClient doesn't appear to be valid anymore.

Copy link
Member

@spong spong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked out, tested locally and code reviewed -- LGTM!

Great stuff here @stephmilovic! Looks/works great and awesome to see it wired up to out-of-band prompt updates! 😀

@stephmilovic stephmilovic enabled auto-merge (squash) June 25, 2025 03:57
@stephmilovic stephmilovic disabled auto-merge June 25, 2025 03:57
@stephmilovic stephmilovic enabled auto-merge (squash) June 25, 2025 06:04
@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #132 / Journey[infra_hosts_view] "before all" hook for "Navigate to Hosts view and load 500 hosts"
  • [job] [logs] FTR Configs #99 / Reporting Functional Tests with Security enabled Access to Management > Reporting Schedules does not allow user to access schedules that does not have reporting privileges

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
automaticImport 758 759 +1
elasticAssistant 410 411 +1
securitySolution 7768 7769 +1
total +3

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/elastic-assistant 175 177 +2

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
elasticAssistant 258.0KB 261.1KB +3.1KB
Unknown metric groups

API count

id before after diff
@kbn/elastic-assistant 208 210 +2

History

@stephmilovic stephmilovic requested a review from a team June 25, 2025 11:49
Copy link
Contributor

@logeekal logeekal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codeowner's review looks good 👍

@stephmilovic stephmilovic merged commit b82ab8a into elastic:main Jun 25, 2025
10 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15875581596

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 25, 2025
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jun 25, 2025
# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Assistant] Starter prompts
(#224981)](#224981)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Steph
Milovic","email":"stephanie.milovic@elastic.co"},"sourceCommit":{"committedDate":"2025-06-25T11:52:31Z","message":"[Security
Assistant] Starter prompts
(#224981)","sha":"b82ab8acb8b5e9e505210943e9f08881c84a20d4","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:
SecuritySolution","Team:Security Generative
AI","backport:version","v9.1.0","v8.19.0"],"title":"[Security Assistant]
Starter
prompts","number":224981,"url":"https://github.com/elastic/kibana/pull/224981","mergeCommit":{"message":"[Security
Assistant] Starter prompts
(#224981)","sha":"b82ab8acb8b5e9e505210943e9f08881c84a20d4"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224981","number":224981,"mergeCommit":{"message":"[Security
Assistant] Starter prompts
(#224981)","sha":"b82ab8acb8b5e9e505210943e9f08881c84a20d4"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels release_note:enhancement Team:Security Generative AI Security Generative AI Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.19.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants