Skip to content

Security ai prompts #871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Apr 2, 2025
Merged

Security ai prompts #871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
261c321
## What does this PR do?
andrew-goldstein Feb 10, 2025
45b6984
fix tests
patrykkopycinski Feb 11, 2025
78cf47a
updates from 870
stephmilovic Mar 26, 2025
2d284ba
Merge branch 'main' into security_ai_prompts
stephmilovic Mar 26, 2025
5927910
fix spec/integration/kibana/spec.yml
stephmilovic Mar 26, 2025
77dacdf
rm sample json from good and good_v2
stephmilovic Mar 26, 2025
5945ba6
integration => content
stephmilovic Mar 27, 2025
9551e8f
add space back
stephmilovic Mar 27, 2025
e54eb29
move test
stephmilovic Mar 27, 2025
ad2c8bf
fix test
stephmilovic Mar 27, 2025
b907186
Merge branch 'main' into security_ai_prompts
jsoriano Apr 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions spec/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@
- description: Add support for semantic_text field definition.
type: enhancement
link: https://github.com/elastic/package-spec/pull/807
- description: Add kibana/security_ai_prompt to support security AI prompt assets.
type: enhancement
link: https://github.com/elastic/package-spec/pull/871
- version: 3.3.5-next
changes:
- description: Allow security_rule assets in content package.
Expand Down
11 changes: 11 additions & 0 deletions spec/content/kibana/spec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,15 @@ spec:
pattern: '^{PACKAGE_NAME}-.+\.json$'
forbiddenPatterns:
- '^.+-(ecs|ECS)\.json$' # ECS suffix is forbidden
- description: Folder containing security AI prompt assets
type: folder
name: "security_ai_prompt"
required: false
contents:
- description: A security AI prompt asset file
type: file
contentMediaType: "application/json"
pattern: '^{PACKAGE_NAME}-.+\.json$'
- description: Folder containing rules
type: folder
name: "security_rule"
Expand All @@ -41,5 +50,7 @@ spec:
versions:
- before: 3.4.0
patch:
- op: remove
path: "/contents/3" # remove AI prompt definitions
- op: remove
path: "/contents/2" # remove SLO definitions
12 changes: 12 additions & 0 deletions test/packages/good_content/kibana/security_ai_prompt/good_content-security-ai-prompt-1.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"attributes": {
"promptId": "systemPrompt",
"promptGroupId": "aiAssistant",
"provider": "openai",
"prompt": {
"default": "You are a security analyst and expert in resolving security incidents. Your role is to assist by answering questions about Elastic Security. Do not answer questions unrelated to Elastic Security."
}
},
"id": "good_content-security-ai-prompt-1",
"type": "security-ai-prompt"
}
Copy link
Member

@jsoriano jsoriano Apr 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am still missing a sample with a real use case. Is the idea to distribute a package with a collection of prompts? Or to associate prompts to specific data?

Copy link
Contributor

@stephmilovic stephmilovic Apr 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I'm confused what else you need here? All the package does is distribute prompts as saved objects. The prompts are looked up with the saved object API within security solution. If no saved object prompt exists, a fallback prompt value exists. https://github.com/elastic/kibana/blob/0d415a6d3a09200dad48a58851d89d81ef897b81/x-pack/solutions/security/packages/security-ai-prompts/src/get_prompt.ts#L109-L113

Copy link
Member

@jsoriano jsoriano Apr 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure about the package that is planned after this new asset is supported. Will it be a package that will contain only a collection of prompts? Or will prompts be added to other packages?

Copy link
Contributor

@stephmilovic stephmilovic Apr 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There will be one new package that contains only a collection of prompts as saved objects, see here: https://github.com/elastic/integrations/pull/13323/files

Copy link
Member

@jsoriano jsoriano Apr 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, then the model proposed here based on content package will fit great.