Security attachments in Agent Builder

.github/CODEOWNERS

@@ -2478,6 +2478,8 @@ x-pack/platform/test/functional/page_objects/search_profiler_page.ts @elastic/se
 /x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/automatic_import @elastic/integration-experience
 /x-pack/solutions/security/plugins/security_solution/public/configurations @elastic/security-generative-ai
 /x-pack/solutions/security/plugins/security_solution_serverless/public/navigation/ai_soc @elastic/security-solution @elastic/security-threat-hunting-investigations
+/x-pack/solutions/security/plugins/security_solution/public/agent_builder @elastic/security-generative-ai
+/x-pack/solutions/security/plugins/security_solution/server/agent_builder @elastic/security-generative-ai
 
 # AI4DSOC in Security Solution
 /x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/ai4dsoc @elastic/security-engineering-productivity

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/roles.yml

@@ -63,6 +63,7 @@ viewer:
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
         - feature_dataQuality.all
+        - feature_agentBuilder.read
       resources: '*'
   run_as: []
 
@@ -159,6 +160,7 @@ editor:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
   run_as: []
 
@@ -218,6 +220,7 @@ t1_analyst:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 t2_analyst:
@@ -280,6 +283,7 @@ t2_analyst:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 t3_analyst:
@@ -362,6 +366,7 @@ t3_analyst:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 threat_intelligence_analyst:
@@ -432,6 +437,7 @@ threat_intelligence_analyst:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 rule_author:
@@ -513,6 +519,7 @@ rule_author:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 soc_manager:
@@ -610,6 +617,7 @@ soc_manager:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 detections_admin:
@@ -684,6 +692,7 @@ detections_admin:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 platform_engineer:
@@ -764,6 +773,7 @@ platform_engineer:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 endpoint_operations_analyst:
@@ -849,6 +859,7 @@ endpoint_operations_analyst:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 endpoint_policy_manager:
@@ -936,6 +947,7 @@ endpoint_policy_manager:
         - feature_maps_v2.all
         - feature_visualize_v2.all
         - feature_savedQueryManagement.all
+        - feature_agentBuilder.all
       resources: '*'
 
 # admin role defined in elasticsearch controller

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/search_ai_lake/roles.yml

@@ -55,6 +55,7 @@ _search_ai_lake_analyst:
         - "feature_savedQueryManagement.read"
         - "feature_indexPatterns.read"
         - "feature_fleetv2.read"
+        - "feature_agentBuilder.all"
       resources: "*"
 
 _search_ai_lake_soc_manager:
@@ -134,4 +135,5 @@ _search_ai_lake_soc_manager:
         - "feature_ml.all"
         - "feature_fleetv2.all"
         - "feature_advancedSettings.all"
+        - "feature_agentBuilder.all"
       resources: "*"

x-pack/platform/packages/shared/onechat/onechat-common/base/namespaces.ts

@@ -12,6 +12,7 @@
 export const internalNamespaces = {
   platformCore: 'platform.core',
   observability: 'observability',
+  security: 'security',
 } as const;
 
 /**
@@ -20,6 +21,7 @@ export const internalNamespaces = {
 export const protectedNamespaces: string[] = [
   internalNamespaces.platformCore,
   internalNamespaces.observability,
+  internalNamespaces.security,
 ];
 
 /**

x-pack/platform/packages/shared/onechat/onechat-common/tools/constants.ts

@@ -26,6 +26,7 @@ export const platformCoreTools = {
   createVisualization: platformCoreTool('create_visualization'),
   getWorkflowExecutionStatus: platformCoreTool('get_workflow_execution_status'),
   productDocumentation: platformCoreTool('product_documentation'),
+  cases: platformCoreTool('cases'),
 } as const;
 
 /**

x-pack/platform/packages/shared/onechat/onechat-server/allow_lists.ts

@@ -6,6 +6,7 @@
  */
 
 import { platformCoreTools } from '@kbn/onechat-common/tools';
+import { internalNamespaces } from '@kbn/onechat-common/base/namespaces';
 
 /**
  * This is a manually maintained list of all built-in tools registered in Agent Builder.
@@ -21,6 +22,10 @@ export const AGENT_BUILDER_BUILTIN_TOOLS: string[] = [
   'observability.get_alerts',
   'observability.get_services',
   'observability.get_downstream_dependencies',
+  // Security Solution
+  `${internalNamespaces.security}.entity_risk_score`,
+  `${internalNamespaces.security}.attack_discovery_search`,
+  `${internalNamespaces.security}.security_labs_search`,
 ];
 
 /**

x-pack/platform/plugins/shared/agent_builder_platform/kibana.jsonc

@@ -11,7 +11,7 @@
     "configPath": ["xpack", "agentBuilderPlatform"],
     "requiredPlugins": ["onechat"],
     "requiredBundles": [],
-    "optionalPlugins": ["llmTasks", "workflowsManagement"],
+    "optionalPlugins": ["cases", "llmTasks", "workflowsManagement"],
     "extraPublicDirs": []
   }
 }

x-pack/platform/plugins/shared/agent_builder_platform/moon.yml

@@ -34,6 +34,9 @@ dependsOn:
   - '@kbn/esql-validation-autocomplete'
   - '@kbn/inference-common'
   - '@kbn/llm-tasks-plugin'
+  - '@kbn/cases-plugin'
+  - '@kbn/core-http-server'
+  - '@kbn/spaces-plugin'
 tags:
   - plugin
   - prod