[Security solution] Security AI prompts integration #216106

stephmilovic · 2025-03-26T20:59:27Z

Summary

Adds config to package the Security AI prompts integration
Adds a script that generates the saved objects to use with the integration
Updates the “bootstrap_prebuilt_rules_handler” route to install the Security AI prompts integration automatically when the user navigates the security solution
Adds a feature flag that is required for the install to happen:
xpack.securitySolution.enableExperimental: ['securityAIPromptsEnabled']

Testing

Add the following to your dev yml

xpack.fleet.internal.registry.spec.max: 3.4
xpack.fleet.internal.registry.kibanaVersionCheckEnabled: false
xpack.fleet.registryUrl: https://epr.elastic.co
xpack.securitySolution.enableExperimental: ['securityAIPromptsEnabled']

Start kibana. Navigate to the Stack Management > Saved Objects view. There should not be any prompt saved objects
Navigate to a security page. Now go back to the Stack Management > Saved Objects view. There should now be prompt saved objects:

Go to the integrations page and click Installed integrations. You should see the prompts package. Click into the package details. You should see a message "This is a pre-release version of Security AI Prompts integration."
Because the prompts are currently identical to the local prompts, there is not a good way to check that they are being used besides adding a log to the code. In x-pack/solutions/security/packages/security-ai-prompts/src/get_prompt.ts, add a log underneath the savedObjectsClient.find like console.log('prompts ==>', prompts);. When you ask the assistant a question, you should see several logs like:

Related issues

https://github.com/elastic/security-team/issues/11196

- update fleet_packages.json - debug logging around installSecurityAiPromptsPackage - updated tests - console logs in x-pack/platform/plugins/shared/fleet/server/services/epm/kibana/assets/install.ts - update schema validation to test latest package_spec - script to generate saved objects

prodsecmachine · 2025-05-01T01:37:26Z

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

jsoriano · 2025-05-06T07:54:28Z

@kpollich a new bundled package is being added here, and a related test fails. Do you know what needs to be updated for this test? Thanks!

elasticmachine · 2025-05-07T14:48:01Z

Pinging @elastic/security-solution (Team: SecuritySolution)

…ovic/kibana into security_ai_prompts_integration

elasticmachine · 2025-05-07T16:58:02Z

Pinging @elastic/fleet (Team:Fleet)

jsoriano · 2025-05-07T17:16:01Z

x-pack/test/fleet_api_integration/apis/epm/install_remove_assets.ts

+        try {
+          securityAiPrompt = await kibanaServer.savedObjects.get({
+            type: 'security-ai-prompt',
+            id: 'sample_security_ai_prompt',


Is it possible to have conflicts if multiple packages have prompts with the same id?

I think that for other assets we prefix their ids with the name of the package to avoid these issues.

The ids will be UUID autogenerated by saved object client, so we will not have this issue. this id was just for tests following other examples

stephmilovic · 2025-05-07T17:54:42Z

@elasticmachine merge upstream

kpollich

Thanks for updating the Fleet API tests. Those changes LGTM.

andrew-goldstein

Thank you @stephmilovic for enabling out of band prompt updates via the Security AI prompts integration! 🙏
✅ Automatic installation of the package is determined by the feature flag
✅ A non-default space installs the integration (desk tested with a clean install)
✅ The Developer Guide instructions in Integrations > Security AI Prompts successfully generate and update the content generated by the x-pack/solutions/security/plugins/elastic_assistant/scripts/generate_security_ai_prompts_script.ts script
LGTM 🚀

xcrzx

Overall LGTM 👍 Added a minor comment on error handling.

xcrzx · 2025-05-08T11:47:08Z

...solution/server/lib/detection_engine/prebuilt_rules/logic/integrations/install_ai_prompts.ts

+  try {
+    await findLatestPackageVersion(context, SECURITY_AI_PROMPTS_PACKAGE_NAME);
+  } catch (e) {
+    // fail silently
+    return null;
+  }
+
+  const pkgVersion = await findLatestPackageVersion(context, SECURITY_AI_PROMPTS_PACKAGE_NAME);
+
+  return context.getInternalFleetServices().packages.ensureInstalledPackage({
+    pkgName: SECURITY_AI_PROMPTS_PACKAGE_NAME,
+    pkgVersion,
+  });


The error should probably be handled like this to avoid a double findLatestPackageVersion call when there's no error:

Suggested change

try {

await findLatestPackageVersion(context, SECURITY_AI_PROMPTS_PACKAGE_NAME);

} catch (e) {

// fail silently

return null;

}

const pkgVersion = await findLatestPackageVersion(context, SECURITY_AI_PROMPTS_PACKAGE_NAME);

return context.getInternalFleetServices().packages.ensureInstalledPackage({

pkgName: SECURITY_AI_PROMPTS_PACKAGE_NAME,

pkgVersion,

});

try {

const pkgVersion = await findLatestPackageVersion(context, SECURITY_AI_PROMPTS_PACKAGE_NAME);

return context.getInternalFleetServices().packages.ensureInstalledPackage({

pkgName: SECURITY_AI_PROMPTS_PACKAGE_NAME,

pkgVersion,

});

} catch (e) {

// fail silently

return null;

}

Another good option would be to adjust findLatestPackageVersion to return null when no package is found, instead of throwing an error. That would help avoid using a clumsy empty catch block, which can backfire in some cases.

stephmilovic · 2025-05-08T20:59:49Z

@elasticmachine merge upstream

elasticmachine · 2025-05-08T22:19:03Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: 02eefe4

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #109 / Cloud Security Posture Cloud Posture Rules Page - Table Headers Rules Page - Enable Rules and Disabled Rules Filter Toggle Should only display Enabled rules when Enabled Rules filter is ON
[job] [logs] FTR Configs #109 / Cloud Security Posture Security Network Page - Graph visualization "before all" hook for "expanded flyout - filter by node"

History

💔 Build #299885 failed 90e3f69
💛 Build #299516 was flaky 49a237d
💔 Build #299506 failed 596ee6c
💔 Build #299455 failed 4832e69
💔 Build #298089 failed 9b5f519

stephmilovic · 2025-05-09T13:55:23Z

@elasticmachine merge upstream

kibanamachine · 2025-05-09T19:39:35Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/14936445575

kibanamachine · 2025-05-09T19:45:48Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 216106

Questions ?

Please refer to the Backport tool documentation

(cherry picked from commit 1176009) # Conflicts: # x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts # x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/bootstrap_prebuilt_rules/bootstrap_prebuilt_rules_handler.ts # x-pack/test/fleet_api_integration/apis/epm/__snapshots__/bulk_get_assets.snap # x-pack/test/fleet_api_integration/apis/epm/update_assets.ts

stephmilovic · 2025-05-09T19:52:39Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…220717) # Backport This will backport the following commits from `main` to `8.19`: - [[Security solution] Security AI prompts integration (#216106)](#216106)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: kibanamachine <[email protected]>

andrew-goldstein and others added 3 commits March 25, 2025 08:47

beta version and feature flag

593512a

rm pirate talk

a49e283

stephmilovic added the release_note:enhancement label Mar 26, 2025

This was referenced Mar 26, 2025

[Security Solution] Security AI Prompts elastic/integrations#13323

Merged

Security ai prompts elastic/package-spec#871

Merged

stephmilovic added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v9.1.0 v8.19.0 labels Mar 27, 2025

stephmilovic added 8 commits March 28, 2025 08:08

Merge branch 'main' into security_ai_prompts_integration

f10e13a

Merge branch 'main' into security_ai_prompts_integration

e66000e

more fix

987e9fa

fix test

ce93e88

fix types

1bff213

Merge branch 'main' into security_ai_prompts_integration

bd13130

test fixing

c37ebf4

type

77e9927

stephmilovic added 7 commits May 1, 2025 08:26

rm tagging

ab70229

Merge branch 'main' into security_ai_prompts_integration

cb06cb2

maybe fixing?

fc38ea6

fix install remove assets test

21097de

rm tag assets test

43d11cf

fix epm test

d0c4af3

fix snapshot

9b5f519

stephmilovic added 2 commits May 6, 2025 08:33

Merge branch 'main' into security_ai_prompts_integration

25a997a

update comment

b4b0b43

stephmilovic added 2 commits May 7, 2025 10:56

exclude package from tests

5bb9f94

Merge branch 'security_ai_prompts_integration' of github.com:stephmil…

b7d574e

…ovic/kibana into security_ai_prompts_integration

botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label May 7, 2025

rm from bundled packages

596ee6c

jsoriano reviewed May 7, 2025

View reviewed changes

Merge branch 'main' into security_ai_prompts_integration

49a237d

kpollich approved these changes May 7, 2025

View reviewed changes

andrew-goldstein approved these changes May 7, 2025

View reviewed changes

xcrzx self-requested a review May 8, 2025 09:54

xcrzx approved these changes May 8, 2025

View reviewed changes

fix error handling

90e3f69

Merge branch 'main' into security_ai_prompts_integration

02eefe4

Merge branch 'main' into security_ai_prompts_integration

bb76dc3

stephmilovic merged commit 1176009 into elastic:main May 9, 2025
9 checks passed

stephmilovic mentioned this pull request May 9, 2025

[8.19] [Security solution] Security AI prompts integration (#216106) #220717

Merged

akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025

[Security solution] Security AI prompts integration (elastic#216106)

c7ffe4c

qn895 pushed a commit to qn895/kibana that referenced this pull request Jun 3, 2025

[Security solution] Security AI prompts integration (elastic#216106)

db4fafc

muskangulati-qasource added ci:cloud-deploy Create or update a Cloud deployment ci:cloud-persist-deployment Persist cloud deployment indefinitely labels Jun 11, 2025

[Security solution] Security AI prompts integration #216106

[Security solution] Security AI prompts integration #216106

Uh oh!

Conversation

stephmilovic commented Mar 26, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Related issues

Uh oh!

prodsecmachine commented May 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎉 Snyk checks have passed. No issues have been found so far.

Uh oh!

jsoriano commented May 6, 2025

Uh oh!

elasticmachine commented May 7, 2025

Uh oh!

elasticmachine commented May 7, 2025

Uh oh!

jsoriano May 7, 2025

Choose a reason for hiding this comment

Uh oh!

stephmilovic May 7, 2025

Choose a reason for hiding this comment

Uh oh!

stephmilovic commented May 7, 2025

Uh oh!

kpollich left a comment

Choose a reason for hiding this comment

Uh oh!

andrew-goldstein left a comment

Choose a reason for hiding this comment

Uh oh!

xcrzx left a comment

Choose a reason for hiding this comment

Uh oh!

xcrzx May 8, 2025

Choose a reason for hiding this comment

Uh oh!

stephmilovic commented May 8, 2025

Uh oh!

elasticmachine commented May 8, 2025

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

stephmilovic commented May 9, 2025

Uh oh!

Uh oh!

kibanamachine commented May 9, 2025

Uh oh!

kibanamachine commented May 9, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

stephmilovic commented May 9, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

stephmilovic commented Mar 26, 2025 •

edited by kibanamachine

Loading

prodsecmachine commented May 1, 2025 •

edited

Loading