Security attachments in Agent Builder

x-pack/platform/packages/shared/onechat/onechat-common/attachments/attachment_types.ts

@@ -16,12 +16,14 @@ export enum AttachmentType {
   screenContext = 'screen_context',
   text = 'text',
   esql = 'esql',
+  product_reference = 'product_reference',
 }
 
 interface AttachmentDataMap {
   [AttachmentType.esql]: EsqlAttachmentData;
   [AttachmentType.text]: TextAttachmentData;
   [AttachmentType.screenContext]: ScreenContextAttachmentData;
+  [AttachmentType.product_reference]: ProductReferenceAttachmentData;
 }
 
 export const esqlAttachmentDataSchema = z.object({
@@ -77,4 +79,16 @@ export interface ScreenContextAttachmentData {
   additional_data?: Record<string, string>;
 }
 
+export const productReferenceAttachmentDataSchema = z.object({
+  text: z.string(),
+});
+
+/**
+ * Data for a product reference attachment.
+ */
+export interface ProductReferenceAttachmentData {
+  /** Text content describing the product reference or query */
+  text: string;
+}
+
 export type AttachmentDataOf<Type extends AttachmentType> = AttachmentDataMap[Type];

x-pack/platform/packages/shared/onechat/onechat-common/attachments/attachments.ts

@@ -29,6 +29,7 @@ export interface Attachment<
 export type TextAttachment = Attachment<AttachmentType.text>;
 export type ScreenContextAttachment = Attachment<AttachmentType.screenContext>;
 export type EsqlAttachment = Attachment<AttachmentType.esql>;
+export type ProductReferenceAttachment = Attachment<AttachmentType.product_reference>;
 
 /**
  * Input version of an attachment, where the id is optional

x-pack/platform/packages/shared/onechat/onechat-common/attachments/index.ts

@@ -11,13 +11,16 @@ export type {
   TextAttachment,
   ScreenContextAttachment,
   EsqlAttachment,
+  ProductReferenceAttachment,
 } from './attachments';
 export {
   AttachmentType,
   textAttachmentDataSchema,
   esqlAttachmentDataSchema,
   screenContextAttachmentDataSchema,
+  productReferenceAttachmentDataSchema,
   type TextAttachmentData,
   type ScreenContextAttachmentData,
   type EsqlAttachmentData,
+  type ProductReferenceAttachmentData,
 } from './attachment_types';

x-pack/platform/packages/shared/onechat/onechat-common/base/namespaces.ts

@@ -12,6 +12,7 @@
 export const internalNamespaces = {
   platformCore: 'platform.core',
   observability: 'observability',
+  security: 'security',
 } as const;
 
 /**
@@ -20,6 +21,7 @@ export const internalNamespaces = {
 export const protectedNamespaces: string[] = [
   internalNamespaces.platformCore,
   internalNamespaces.observability,
+  internalNamespaces.security,
 ];
 
 /**

x-pack/platform/packages/shared/onechat/onechat-common/tools/constants.ts

@@ -25,6 +25,7 @@ export const platformCoreTools = {
   executeEsql: platformCoreTool('execute_esql'),
   createVisualization: platformCoreTool('create_visualization'),
   task: platformCoreTool('task'),
+  cases: platformCoreTool('cases'),
 } as const;
 
 /**

x-pack/platform/packages/shared/onechat/onechat-server/allow_lists.ts

@@ -6,6 +6,7 @@
  */
 
 import { platformCoreTools } from '@kbn/onechat-common/tools';
+import { internalNamespaces } from '@kbn/onechat-common/base/namespaces';
 
 /**
  * This is a manually maintained list of all built-in tools registered in Agent Builder.
@@ -21,6 +22,10 @@ export const AGENT_BUILDER_BUILTIN_TOOLS: string[] = [
   'observability.get_alerts',
   'observability.get_services',
   'observability.get_downstream_dependencies',
+  // Security Solution
+  `${internalNamespaces.security}.entity_risk_score`,
+  `${internalNamespaces.security}.attack_discovery_search`,
+  `${internalNamespaces.security}.security_labs_search`,
 ];
 
 /**

x-pack/platform/plugins/shared/onechat/kibana.jsonc

@@ -34,6 +34,7 @@
       "kibanaReact"
     ],
     "optionalPlugins": [
+      "cases",
       "cloud",
       "licenseManagement",
       "workflowsManagement",

x-pack/platform/plugins/shared/onechat/server/services/attachments/definitions/index.ts

@@ -10,12 +10,14 @@ import { createTextAttachmentType } from './text';
 import { createEsqlAttachmentType } from './esql';
 import { createScreenContextAttachmentType } from './screen_context';
 import type { AttachmentServiceSetup } from '../types';
+import { createProductReferenceAttachmentType } from './product_reference';
 
 export const registerAttachmentTypes = ({ registry }: { registry: AttachmentServiceSetup }) => {
   const attachmentTypes: AttachmentTypeDefinition<any, any>[] = [
     createTextAttachmentType(),
     createScreenContextAttachmentType(),
     createEsqlAttachmentType(),
+    createProductReferenceAttachmentType(),
   ];
 
   attachmentTypes.forEach((attachmentType) => {

x-pack/platform/plugins/shared/onechat/server/services/attachments/definitions/product_reference.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ProductReferenceAttachmentData } from '@kbn/onechat-common/attachments';
+import {
+  AttachmentType,
+  productReferenceAttachmentDataSchema,
+} from '@kbn/onechat-common/attachments';
+import type { AttachmentTypeDefinition } from '@kbn/onechat-server/attachments';
+import { sanitizeToolId } from '@kbn/onechat-genai-utils/langchain';
+
+/**
+ * Creates the definition for the `product_reference` attachment type.
+ */
+export const createProductReferenceAttachmentType = (): AttachmentTypeDefinition<
+  AttachmentType.product_reference,
+  ProductReferenceAttachmentData
+> => {
+  return {
+    id: AttachmentType.product_reference,
+    validate: (input) => {
+      const parseResult = productReferenceAttachmentDataSchema.safeParse(input);
+      if (parseResult.success) {
+        return { valid: true, data: parseResult.data };
+      } else {
+        return { valid: false, error: parseResult.error.message };
+      }
+    },
+    format: (attachment) => {
+      return {
+        getRepresentation: () => {
+          return { type: 'text', value: formatProductReferenceData(attachment.data) };
+        },
+      };
+    },
+    // TODO use real tool once https://github.com/elastic/kibana/pull/242598 merges, same in description below
+    getTools: () => [`platformCoreTools.productDocumentation`],
+    getAgentDescription: () => {
+      const description = `You have access to a product reference that needs to be queried for documentation.
+
+PRODUCT REFERENCE DATA:
+{productReferenceData}
+
+---
+MANDATORY WORKFLOW:
+
+1. Extract the query or topic from the product reference data above.
+
+2. Query PRODUCT DOCUMENTATION for relevant documentation:
+   Tool: ${sanitizeToolId(`platformCoreTools.productDocumentation`)}
+   Parameters: {
+     query: "[extracted query or topic from the product reference]",
+     product: "[optional: 'kibana' | 'elasticsearch' | 'observability' | 'security']",
+     max: 3
+   }`;
+      return description;
+    },
+  };
+};
+
+/**
+ * Formats product reference data for display.
+ *
+ * @param data - The product reference attachment data containing the text
+ * @returns Formatted string representation of the product reference data
+ */
+const formatProductReferenceData = (data: ProductReferenceAttachmentData): string => {
+  return data.text;
+};