[Security Solution] [GenAi] Use default LLM setting for security GenAi features by KDKHD · Pull Request #234480 · elastic/kibana

KDKHD · 2025-09-09T16:07:17Z

Summary

Summarize your PR. If it involves visual changes include a screenshot or gif.

This PR integrates the new default LLM setting with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery.

How to test:

Start Kibana locally from this branch
Make sure you have at least 3 LLM connectors configured (can be preconfigured ones).
Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier)

Enable the feature flag by adding the following to kibana.dev.yml:

feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true

Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings
Select a default LLM:

Save the setting change using the footer at the bottom of the page.
Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly)
Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors.
Change the LLM to a non-default connector for the conversation.
Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation.
Now back on the GenAi settings page, check the Disallow all other connectors checkbox.
Open the AI assistant again and go to the existing conversation that has a few messages inside.
You should see a red banner indicating that a connector needs to be selected.
If you open the connector selector, you should now only see the default LLM you have configured as an option.

Attack Discovery

In attack discovery, you should observe the same behavior.

Go to attack discovery http://localhost:5601/app/security/attack_discovery
Open the manual run config flyout

Verify that only the default LLM is available as the connector:

Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the Disallow all other connectors checkbox and select a different default connector.
Go to Attack Discovery and open the manual run config flyout again.
Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors.

TODO

The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for feaures that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

See some risk examples
...

…no-cache --fix'

...atform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector/index.tsx

qn895 · 2025-09-09T18:14:51Z

...tform/packages/shared/kbn-elastic-assistant/impl/connectorland/use_load_connectors/index.tsx

+      const allAiConnectors = connectors.flatMap((connector) => {
        if (!connector.isMissingSecrets && actionTypes.includes(connector.actionTypeId)) {
-          acc.push({
+          const aiConnector: AIConnector = {


PhilippeOberti

Approving for @elastic/security-threat-hunting-investigations team as only a small change in a single file impacts us.

A PR description would be nice though 😉

kibanamachine · 2025-09-25T10:22:16Z

💔 All backports failed

Status	Branch	Result
❌	8.18	Backport failed because of merge conflicts You might need to backport the following PRs to 8.18: - [SecuritySolution] Make last conversation local storage keys space aware (#214794)
❌	8.19	Backport failed because of merge conflicts
❌	9.0	Backport failed because of merge conflicts
❌	9.1	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 234480

Questions ?

Please refer to the Backport tool documentation

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit b543b8c) # Conflicts: # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/conversations/conversation_settings/conversation_settings_editor.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.test.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/use_load_connectors/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/mock/test_providers/test_providers.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/tsconfig.json # x-pack/platform/plugins/private/gen_ai_settings/public/components/default_ai_connector/default_ai_connector.tsx # x-pack/solutions/security/packages/ecs-data-quality-dashboard/impl/data_quality_panel/mock/test_providers/test_providers.tsx

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit b543b8c) # Conflicts: # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/conversations/conversation_settings/conversation_settings_editor.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.test.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/use_load_connectors/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/mock/test_providers/test_providers.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/tsconfig.json # x-pack/platform/plugins/private/gen_ai_settings/public/components/default_ai_connector/default_ai_connector.tsx # x-pack/solutions/security/packages/ecs-data-quality-dashboard/impl/data_quality_panel/mock/test_providers/test_providers.tsx # x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/insights/workflow_insights_scan.tsx

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit b543b8c) # Conflicts: # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/chat_complete/use_chat_complete.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/conversations/conversation_settings/conversation_settings_editor.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.test.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant_context/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/use_load_connectors/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/mock/test_providers/test_providers.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/tsconfig.json # x-pack/platform/plugins/private/gen_ai_settings/public/components/default_ai_connector/default_ai_connector.tsx # x-pack/solutions/security/packages/ecs-data-quality-dashboard/impl/data_quality_panel/mock/test_providers/test_providers.tsx # x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/index.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/create_flyout/index.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/details_flyout/index.tsx # x-pack/solutions/security/plugins/security_solution/public/common/mock/mock_assistant_provider.tsx # x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/insights/workflow_insights_scan.tsx # x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_card.tsx

KDKHD · 2025-09-25T14:53:22Z

💚 All backports created successfully

Status	Branch	Result
✅	8.18

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…i features (elastic#234480) Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit b543b8c) # Conflicts: # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/chat_complete/use_chat_complete.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/conversations/conversation_settings/conversation_settings_editor.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.test.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant_context/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/use_load_connectors/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/mock/test_providers/test_providers.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/tsconfig.json # x-pack/platform/plugins/private/gen_ai_settings/public/components/default_ai_connector/default_ai_connector.tsx # x-pack/platform/plugins/private/gen_ai_settings/public/contexts/settings_context.tsx # x-pack/solutions/security/packages/ecs-data-quality-dashboard/impl/data_quality_panel/mock/test_providers/test_providers.tsx # x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/index.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/create_flyout/index.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/details_flyout/index.tsx # x-pack/solutions/security/plugins/security_solution/public/common/mock/mock_assistant_provider.tsx # x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_card.tsx

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit b543b8c) # Conflicts: # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/chat_complete/use_chat_complete.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/conversations/conversation_settings/conversation_settings_editor.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.test.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/helpers.ts # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/assistant_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.test.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/settings/search_ai_lake_configurations_settings_management.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant_context/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/use_load_connectors/index.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/impl/mock/test_providers/test_providers.tsx # x-pack/platform/packages/shared/kbn-elastic-assistant/tsconfig.json # x-pack/platform/plugins/private/gen_ai_settings/public/components/default_ai_connector/default_ai_connector.tsx # x-pack/solutions/security/packages/ecs-data-quality-dashboard/impl/data_quality_panel/mock/test_providers/test_providers.tsx # x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/index.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/create_flyout/index.tsx # x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/details_flyout/index.tsx # x-pack/solutions/security/plugins/security_solution/public/common/mock/mock_assistant_provider.tsx # x-pack/solutions/security/plugins/security_solution/public/onboarding/components/onboarding_body/cards/assistant/assistant_card.tsx

KDKHD · 2025-09-26T12:26:03Z

💚 All backports created successfully

Status	Branch	Result
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…y GenAi features (#234480) (#236461) # Backport This will backport the following commits from `main` to `9.1`: - [[Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480)](#234480)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…ty GenAi features (#234480) (#236464) # Backport This will backport the following commits from `main` to `8.19`: - [[Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480)](#234480)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2025-09-29T14:49:21Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @KDKHD

…y GenAi features (#234480) (#236587) # Backport This will backport the following commits from `main` to `9.0`: - [[Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480)](#234480)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…i features (#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…ty GenAi features (#234480) (#236473) # Backport This will backport the following commits from `main` to `8.18`: - [[Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480)](#234480)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

KDKHD · 2025-10-06T14:15:13Z

All backports merged:

Status	Branch	Result
✅	9.0
✅	8.18
✅	8.19
✅	9.1

…i features (elastic#234480) ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. This PR integrates the new [default LLM setting](elastic#231940) with the security solution GenAI features (AI assistant and Attack discovery). The default LLM setting allows admins to configure the preferred AI connector. This PR make sure that this setting is actually respected in the AI assistant and Attack discovery. ### How to test: - Start Kibana locally from this branch - Make sure you have at least 3 LLM connectors configured (can be preconfigured ones). - Go to stack management > advanced settings and switch the following setting to "Security AI assistant in other apps". (This will make testing a little bit easier) <img width="1954" height="133" alt="image" src="https://github.com/user-attachments/assets/12fc4313-b2a5-45f7-bca9-8e0e7ee7f19e" /> - Enable the feature flag by adding the following to kibana.dev.yml: ``` feature_flags.overrides.aiAssistant.defaultLlmSettingEnabled: true ``` - Go to the GenAi Settings page: http://localhost:5601/app/management/ai/genAiSettings - Select a default LLM: <img width="2524" height="775" alt="image" src="https://github.com/user-attachments/assets/d8c51f46-04d2-42bf-871b-735fa3849d30" /> - Save the setting change using the footer at the bottom of the page. - Open the Security AI assistant (if you changed the Assistant visibility setting, you can open the assistant from the GenAi page directly) - Check that the LLM connector for the conversation is the one you configured as the default LLM. Also, verify that you can still change the connector used in your conversation to one of your other connectors. - Change the LLM to a non-default connector for the conversation. - Once you select a non-default connector, chat with the assistant and then start a new conversation, your non-default connector should still be active for the new conversation. - Now back on the GenAi settings page, check the `Disallow all other connectors` checkbox. - Open the AI assistant again and go to the existing conversation that has a few messages inside. - You should see a red banner indicating that a connector needs to be selected. - If you open the connector selector, you should now only see the default LLM you have configured as an option. #### Attack Discovery In attack discovery, you should observe the same behavior. - Go to attack discovery http://localhost:5601/app/security/attack_discovery - Open the manual run config flyout <img width="3081" height="1184" alt="image" src="https://github.com/user-attachments/assets/a5a11f1e-8b0b-40d9-8937-6fe4497cbf10" /> - Verify that only the default LLM is available as the connector: <img width="1698" height="833" alt="image" src="https://github.com/user-attachments/assets/45b68d6c-6f36-487f-ba08-030f41c10545" /> - Go back to the GenAi settings page http://localhost:5601/app/management/ai/genAiSettings and deselect the `Disallow all other connectors` checkbox and select a different default connector. - Go to Attack Discovery and open the manual run config flyout again. - Check that by default, your new default connector is used. Also, verify that you now again have the option of changing the connector to any of the other configured connectors. ### TODO The designs of the connector selector for Attack discovery and the Assistant still need to be implemented. That will be done in a separate PR. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for feaures that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [X] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

use default LLM setting in security solution GenAi

bb5afe9

KDKHD marked this pull request as ready for review September 9, 2025 16:07

KDKHD requested review from a team as code owners September 9, 2025 16:07

lint

267845a

KDKHD force-pushed the feature/default-llm-security branch from a093286 to 267845a Compare September 9, 2025 16:38

KDKHD requested review from a team as code owners September 9, 2025 16:38

KDKHD requested review from parkiino and tomsonpl September 9, 2025 16:38

KDKHD and others added 4 commits September 9, 2025 17:41

bootstrap

3e517a2

[CI] Auto-commit changed files from 'node scripts/yarn_deduplicate'

b035cfe

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

fd7d96a

…no-cache --fix'

[CI] Auto-commit changed files from 'node scripts/yarn_deduplicate'

320aad1

qn895 reviewed Sep 9, 2025

View reviewed changes

...atform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector/index.tsx Outdated Show resolved Hide resolved

qn895 reviewed Sep 9, 2025

View reviewed changes

...atform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector/index.tsx Outdated Show resolved Hide resolved

qn895 reviewed Sep 9, 2025

View reviewed changes

PhilippeOberti approved these changes Sep 9, 2025

View reviewed changes

KDKHD changed the title ~~[Security Solution] [GenAi] Use default LLM setting for security GenAi features~~ [Security Solution] [GenAi] Use default LLM setting for security GenAi features WIP Sep 10, 2025

KDKHD changed the title ~~[Security Solution] [GenAi] Use default LLM setting for security GenAi features WIP~~ [Security Solution] [GenAi] Use default LLM setting for security GenAi features Sep 10, 2025

KDKHD added 3 commits September 10, 2025 12:07

lint

6ded1be

lint

5004700

cr

1a5f789

KDKHD added release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v9.2.0 v9.1.4 v9.0.7 labels Sep 10, 2025

KDKHD mentioned this pull request Sep 25, 2025

[9.1] [Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480) #236461

Merged

KDKHD mentioned this pull request Sep 25, 2025

[8.19] [Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480) #236464

Merged

KDKHD mentioned this pull request Sep 25, 2025

[8.18] [Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480) #236473

Merged

KDKHD mentioned this pull request Sep 26, 2025

[9.0] [Security Solution] [GenAi] Use default LLM setting for security GenAi features (#234480) #236587

Merged

kibanamachine added the v9.1.5 label Sep 26, 2025

kibanamachine added v8.19.5 backport missing Added to PRs automatically when the are determined to be missing a backport. labels Sep 26, 2025

kibanamachine added the v9.0.8 label Sep 29, 2025

kibanamachine added v8.18.8 and removed backport missing Added to PRs automatically when the are determined to be missing a backport. labels Sep 30, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] [GenAi] Use default LLM setting for security GenAi features#234480

[Security Solution] [GenAi] Use default LLM setting for security GenAi features#234480
KDKHD merged 20 commits intoelastic:mainfrom
KDKHD:feature/default-llm-security

KDKHD commented Sep 9, 2025 •

edited by kibanamachine

Loading

Uh oh!

Uh oh!

Uh oh!

qn895 Sep 9, 2025

Uh oh!

PhilippeOberti left a comment

Uh oh!

kibanamachine commented Sep 25, 2025

Uh oh!

KDKHD commented Sep 25, 2025

Uh oh!

KDKHD commented Sep 26, 2025

Uh oh!

kibanamachine commented Sep 29, 2025

Uh oh!

KDKHD commented Oct 6, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Conversation

KDKHD commented Sep 9, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to test:

Attack Discovery

TODO

Checklist

Identify risks

Uh oh!

Uh oh!

Uh oh!

qn895 Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Sep 25, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

KDKHD commented Sep 25, 2025

💚 All backports created successfully

Questions ?

Uh oh!

KDKHD commented Sep 26, 2025

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented Sep 29, 2025

Uh oh!

KDKHD commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

KDKHD commented Sep 9, 2025 •

edited by kibanamachine

Loading

KDKHD commented Oct 6, 2025 •

edited

Loading