Skip to content

[Spike][Security Solution] AI SOC: Default Agent skills, tools, and workflow playbooks - #259559

Draft
patrykkopycinski wants to merge 9 commits into
elastic:mainfrom
patrykkopycinski:elastic-ai-soc-plan
Draft

[Spike][Security Solution] AI SOC: Default Agent skills, tools, and workflow playbooks#259559
patrykkopycinski wants to merge 9 commits into
elastic:mainfrom
patrykkopycinski:elastic-ai-soc-plan

Changes from node scripts/eslint_all_files --no-cache --fix

7a954bc
Select commit
Loading
Failed to load commit list.
MacroscopeApp / Macroscope - Correctness Check completed Mar 25, 2026 in 15m 21s

1 issue identified (28 code objects reviewed).

• Merge Base: e9d79de
• Head: 7a954bc

Details

✅ File Path Comments Posted
❌ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/chat_client.ts 1
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/case_manage_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/mitre_mapping_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/report_generate_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/timeline_create_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/case_manage_tool.test.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/response_actions_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/entity_store_query_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/mitre_mapping_tool.test.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/threat_intel_enrich_tool.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/timeline_create_tool.test.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/response_actions_tool.test.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/threat_intel_enrich_tool.test.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/triage_agent/triage_agent.spec.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/reporter_agent/reporter_agent.spec.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/responder_agent/responder_agent.spec.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/correlator_agent/correlator_agent.spec.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/investigator_agent/investigator_agent.spec.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/__integration__/soc_tools.integration.test.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/evals/mitre_analyst_agent/mitre_analyst_agent.spec.ts 0
➖ x-pack/solutions/security/plugins/security_solution/common/constants.ts
✅ x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/index.ts 0
✅ x-pack/solutions/security/plugins/security_solution/server/plugin.ts 0

Filtered Issues Details

x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/__integration__/soc_tools.integration.test.ts
  • line 122: The test at lines 122-127 incorrectly accesses m.provider to verify match sources, but based on the mock data structure and how threatIntelEnrichTool constructs matches (spreading hit._source with index), the provider is nested at m.threat.indicator.provider, not m.provider. The current code will produce [undefined, undefined, undefined] and the assertions expect(providers).toContain('AbuseCH') etc. will fail. [ Failed validation ]
x-pack/solutions/security/plugins/security_solution/server/agent_builder/tools/case_manage_tool.ts
  • line 230: At line 230, updatedCases[0] is accessed without checking if the array is non-empty. If casesClient.cases.update returns an empty array (unexpected but possible), accessing properties like .id, .title on undefined will throw a TypeError. The same issue exists at line 480 with statusUpdatedCases[0]. [ Already posted ]
View more details on MacroscopeApp