Skip to content

Commit f6383b7

Browse files
joeypoonCAWilson94
joeypoon
authored and
CAWilson94
committed
[Security Solution] add defend insights elastic assistant tool (elastic#198676)
### Summary Adds the new Defend Insights Elastic Assistant tool. This assistant tool provides Elastic Defend configuration insights. For this initial PR, only incompatible antivirus detection is supported. Telemetry is collected for success and error events. For incompatible antivirus detection, Defend Insights will review the last 200 file events for the given endpoint and output suspected antiviruses. Improvements such as customizable event count and date range will come in the future. This PR does not include any UI, that will come in a separate PR. 3 internal APIs for interacting with Defend Insights are provided here: - `POST /defend_insights` for creating a new Defend Insight - `GET /defend_insights/{id}` for getting a Defend Insight - `GET /defend_insights` for getting multiple Defend Insights - available optional query params: - `size` - default 10 - `ids` - `connector_id` - `type` - `incompatible_antivirus` - `status` - `running`, `completed`, `failed`, `canceled` - `endpoint_ids` This initial implementation does not include the LangGraph/output chunking upgrades seen in Attack Discovery due to time constraints. We'll look to make this upgrade in a future PR. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
1 parent ce9a969 commit f6383b7

File tree

59 files changed

+4574
-10
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+4574
-10
lines changed

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2158,6 +2158,7 @@ x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout @elastic/
21582158
/x-pack/plugins/security_solution/public/flyout/document_details/isolate_host/ @elastic/security-defend-workflows
21592159
/x-pack/plugins/security_solution/common/endpoint/ @elastic/security-defend-workflows
21602160
/x-pack/plugins/security_solution/common/api/endpoint/ @elastic/security-defend-workflows
2161+
x-pack/plugins/security_solution/server/assistant/tools/defend_insights @elastic/security-defend-workflows
21612162
/x-pack/plugins/security_solution/server/endpoint/ @elastic/security-defend-workflows
21622163
/x-pack/plugins/security_solution/server/lists_integration/endpoint/ @elastic/security-defend-workflows
21632164
/x-pack/plugins/security_solution/server/lib/license/ @elastic/security-defend-workflows
@@ -2169,6 +2170,10 @@ x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout @elastic/
21692170
/x-pack/plugins/security_solution_serverless/public/upselling/sections/endpoint_management @elastic/security-defend-workflows
21702171
/x-pack/plugins/security_solution_serverless/public/upselling/pages/endpoint_management @elastic/security-defend-workflows
21712172
/x-pack/plugins/security_solution_serverless/server/endpoint @elastic/security-defend-workflows
2173+
x-pack/packages/kbn-elastic-assistant-common/impl/schemas/defend_insights @elastic/security-defend-workflows
2174+
x-pack/plugins/elastic_assistant/server/__mocks__/defend_insights_schema.mock.ts @elastic/security-defend-workflows
2175+
x-pack/plugins/elastic_assistant/server/ai_assistant_data_clients/defend_insights @elastic/security-defend-workflows
2176+
x-pack/plugins/elastic_assistant/server/routes/defend_insights @elastic/security-defend-workflows
21722177

21732178
## Security Solution sub teams - security-telemetry (Data Engineering)
21742179
x-pack/plugins/security_solution/server/usage/ @elastic/security-data-analytics

‎x-pack/packages/kbn-elastic-assistant-common/constants.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,8 @@ export const ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_INDICES_URL =
5555

5656
export const ELASTIC_AI_ASSISTANT_EVALUATE_URL =
5757
`${ELASTIC_AI_ASSISTANT_INTERNAL_URL}/evaluate` as const;
58+
59+
// Defend insights
60+
export const DEFEND_INSIGHTS_TOOL_ID = 'defend-insights';
61+
export const DEFEND_INSIGHTS = `${ELASTIC_AI_ASSISTANT_INTERNAL_URL}/defend_insights`;
62+
export const DEFEND_INSIGHTS_BY_ID = `${DEFEND_INSIGHTS}/{id}`;

‎x-pack/packages/kbn-elastic-assistant-common/impl/capabilities/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,5 @@ export type AssistantFeatureKey = keyof AssistantFeatures;
2020
*/
2121
export const defaultAssistantFeatures = Object.freeze({
2222
assistantModelEvaluation: false,
23+
defendInsights: false,
2324
});

‎x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,5 @@ import { z } from '@kbn/zod';
1919
export type GetCapabilitiesResponse = z.infer<typeof GetCapabilitiesResponse>;
2020
export const GetCapabilitiesResponse = z.object({
2121
assistantModelEvaluation: z.boolean(),
22+
defendInsights: z.boolean(),
2223
});

‎x-pack/packages/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,11 @@ paths:
2222
properties:
2323
assistantModelEvaluation:
2424
type: boolean
25+
defendInsights:
26+
type: boolean
2527
required:
2628
- assistantModelEvaluation
29+
- defendInsights
2730
'400':
2831
description: Generic Error
2932
content:

‎x-pack/packages/kbn-elastic-assistant-common/impl/schemas/defend_insights/common_attributes.gen.ts‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
/*
9+
* NOTICE: Do not edit this file manually.
10+
* This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
11+
*
12+
* info:
13+
* title: Common Defend Insights Attributes
14+
* version: not applicable
15+
*/
16+
17+
import { z } from '@kbn/zod';
18+
19+
import { NonEmptyString, User } from '../common_attributes.gen';
20+
import { Replacements, ApiConfig } from '../conversations/common_attributes.gen';
21+
22+
/**
23+
* A Defend insight event
24+
*/
25+
export type DefendInsightEvent = z.infer<typeof DefendInsightEvent>;
26+
export const DefendInsightEvent = z.object({
27+
/**
28+
* The event's ID
29+
*/
30+
id: z.string(),
31+
/**
32+
* The endpoint's ID
33+
*/
34+
endpointId: z.string(),
35+
/**
36+
* The value of the event
37+
*/
38+
value: z.string(),
39+
});
40+
41+
/**
42+
* The insight type (ie. incompatible_antivirus)
43+
*/
44+
export type DefendInsightType = z.infer<typeof DefendInsightType>;
45+
export const DefendInsightType = z.enum(['incompatible_antivirus', 'noisy_process_tree']);
46+
export type DefendInsightTypeEnum = typeof DefendInsightType.enum;
47+
export const DefendInsightTypeEnum = DefendInsightType.enum;
48+
49+
/**
50+
* A Defend insight generated from endpoint events
51+
*/
52+
export type DefendInsight = z.infer<typeof DefendInsight>;
53+
export const DefendInsight = z.object({
54+
/**
55+
* The group category of the events (ie. Windows Defender)
56+
*/
57+
group: z.string(),
58+
/**
59+
* An array of event objects
60+
*/
61+
events: z.array(DefendInsightEvent).optional(),
62+
});
63+
64+
/**
65+
* Array of Defend insights
66+
*/
67+
export type DefendInsights = z.infer<typeof DefendInsights>;
68+
export const DefendInsights = z.array(DefendInsight);
69+
70+
/**
71+
* The status of the Defend insight.
72+
*/
73+
export type DefendInsightStatus = z.infer<typeof DefendInsightStatus>;
74+
export const DefendInsightStatus = z.enum(['running', 'succeeded', 'failed', 'canceled']);
75+
export type DefendInsightStatusEnum = typeof DefendInsightStatus.enum;
76+
export const DefendInsightStatusEnum = DefendInsightStatus.enum;
77+
78+
/**
79+
* Run durations for the Defend insight
80+
*/
81+
export type DefendInsightGenerationInterval = z.infer<typeof DefendInsightGenerationInterval>;
82+
export const DefendInsightGenerationInterval = z.object({
83+
/**
84+
* The time the Defend insight was generated
85+
*/
86+
date: z.string(),
87+
/**
88+
* The duration of the Defend insight generation
89+
*/
90+
durationMs: z.number().int(),
91+
});
92+
93+
export type DefendInsightsResponse = z.infer<typeof DefendInsightsResponse>;
94+
export const DefendInsightsResponse = z.object({
95+
id: NonEmptyString,
96+
timestamp: NonEmptyString.optional(),
97+
/**
98+
* The last time the Defend insight was updated.
99+
*/
100+
updatedAt: z.string(),
101+
/**
102+
* The last time the Defend insight was viewed in the browser.
103+
*/
104+
lastViewedAt: z.string(),
105+
/**
106+
* The number of events in the context.
107+
*/
108+
eventsContextCount: z.number().int().optional(),
109+
/**
110+
* The time the Defend insight was created.
111+
*/
112+
createdAt: z.string(),
113+
replacements: Replacements.optional(),
114+
users: z.array(User),
115+
/**
116+
* The status of the Defend insight.
117+
*/
118+
status: DefendInsightStatus,
119+
endpointIds: z.array(NonEmptyString),
120+
insightType: DefendInsightType,
121+
/**
122+
* The Defend insights.
123+
*/
124+
insights: DefendInsights,
125+
/**
126+
* LLM API configuration.
127+
*/
128+
apiConfig: ApiConfig,
129+
/**
130+
* Kibana space
131+
*/
132+
namespace: z.string(),
133+
/**
134+
* The backing index required for update requests.
135+
*/
136+
backingIndex: z.string(),
137+
/**
138+
* The most 5 recent generation intervals
139+
*/
140+
generationIntervals: z.array(DefendInsightGenerationInterval),
141+
/**
142+
* The average generation interval in milliseconds
143+
*/
144+
averageIntervalMs: z.number().int(),
145+
/**
146+
* The reason for a status of failed.
147+
*/
148+
failureReason: z.string().optional(),
149+
});
150+
151+
export type DefendInsightUpdateProps = z.infer<typeof DefendInsightUpdateProps>;
152+
export const DefendInsightUpdateProps = z.object({
153+
id: NonEmptyString,
154+
/**
155+
* LLM API configuration.
156+
*/
157+
apiConfig: ApiConfig.optional(),
158+
/**
159+
* The number of events in the context.
160+
*/
161+
eventsContextCount: z.number().int().optional(),
162+
/**
163+
* The Defend insights.
164+
*/
165+
insights: DefendInsights.optional(),
166+
/**
167+
* The status of the Defend insight.
168+
*/
169+
status: DefendInsightStatus.optional(),
170+
replacements: Replacements.optional(),
171+
/**
172+
* The most 5 recent generation intervals
173+
*/
174+
generationIntervals: z.array(DefendInsightGenerationInterval).optional(),
175+
/**
176+
* The backing index required for update requests.
177+
*/
178+
backingIndex: z.string(),
179+
/**
180+
* The reason for a status of failed.
181+
*/
182+
failureReason: z.string().optional(),
183+
/**
184+
* The last time the Defend insight was viewed in the browser.
185+
*/
186+
lastViewedAt: z.string().optional(),
187+
});
188+
189+
export type DefendInsightsUpdateProps = z.infer<typeof DefendInsightsUpdateProps>;
190+
export const DefendInsightsUpdateProps = z.array(DefendInsightUpdateProps);
191+
192+
export type DefendInsightCreateProps = z.infer<typeof DefendInsightCreateProps>;
193+
export const DefendInsightCreateProps = z.object({
194+
/**
195+
* The Defend insight id.
196+
*/
197+
id: z.string().optional(),
198+
/**
199+
* The status of the Defend insight.
200+
*/
201+
status: DefendInsightStatus,
202+
/**
203+
* The number of events in the context.
204+
*/
205+
eventsContextCount: z.number().int().optional(),
206+
endpointIds: z.array(NonEmptyString),
207+
insightType: DefendInsightType,
208+
/**
209+
* The Defend insights.
210+
*/
211+
insights: DefendInsights,
212+
/**
213+
* LLM API configuration.
214+
*/
215+
apiConfig: ApiConfig,
216+
replacements: Replacements.optional(),
217+
});

0 commit comments

Comments
 (0)