You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: solutions/security/ai/ai-assistant-knowledge-base.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,7 @@ AI Assistant’s Knowledge Base feature enables AI Assistant to recall specific
27
27
::::
28
28
29
29
::::{note}
30
-
It is highly recommended to [enable autoscaling](/deploy-manage/autoscaling.md#cluster-autoscaling)to use the AI Assistant Knowledge Base.
30
+
We strongly recommend you [enable autoscaling](/deploy-manage/autoscaling.md#cluster-autoscaling)before using Knowledge Base.
31
31
::::
32
32
33
33
## Role-based access control (RBAC) for Knowledge Base [knowledge-base-rbac]
@@ -53,7 +53,6 @@ You must individually enable Knowledge Base for each {{kib}} space where you wan
53
53
::::
54
54
55
55
56
-
57
56
### Option 1: Enable Knowledge Base from an AI Assistant conversation [_option_1_enable_knowledge_base_from_an_ai_assistant_conversation]
58
57
59
58
Open a conversation with AI Assistant, select a large language model, then click **Setup Knowledge Base**. If the button doesn’t appear, Knowledge Base is already enabled.
Copy file name to clipboardExpand all lines: solutions/security/ai/usecase-knowledge-base-walkthrough.md
+5-37Lines changed: 5 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,45 +8,13 @@ products:
8
8
---
9
9
10
10
11
-
# Use the AI Assistant's Knowledge Base to Supercharge Security Operations
11
+
# Use AI Assistant's Knowledge Base to Supercharge Security Operations
12
12
13
-
AI Assistant Knowledge Base feature lets you provide custom, organization-specific context to the AI Assistant, making its responses more accurate, relevant, and actionable. By adding documents, indices, and external data sources, you can tailor the assistant to your environment, SOC strategy, threat intelligence, and operational workflows.
14
-
15
-
## Overview
16
-
17
-
-**What is the Knowledge Base?**
18
-
- A feature that allows the AI Assistant to recall and use custom documents and indices as context for its responses.
19
-
- Supports everything from infrastructure details, on-call rotations, SOC playbooks, threat intelligence, and more.
20
-
- Entries can be private (user-specific) or global (shared across the space).
21
-
22
-
-**Why use it?**
23
-
- Increases the utility of the Security AI Assistant by grounding answers in your organization’s real data and processes.
24
-
- Enables richer, more actionable responses for incident response, alert investigation, and SOC operations.
13
+
This guide walks you through an example of how you can give custom information to the AI Assistant to customize it for your needs and improve the quality of its responses. It can remember everything from threat hunting playbooks, to on-call rotations, security research, infrastructure information, your team's internal communications from platforms like Slack or Teams, and more — constrained only by your creativity.
25
14
26
15
## Prerequisites
27
16
28
-
- Required privileges: `Elastic AI Assistant: All` (with sub-privileges for Knowledge Base and Field Selection/Anonymization).
29
-
- Machine Learning enabled (minimum 4 GB ML node).
30
-
-[Enable autoscaling](https://www.elastic.co/guide/en/cloud/current/autoscaling.html) is recommended.
31
-
- Knowledge Base must be enabled for each Kibana space individually.
32
-
33
-
## Step 1: Enable the Knowledge Base
34
-
35
-
-**From an AI Assistant conversation:**
36
-
- Open a chat, select a model, and click **Setup Knowledge Base** (button only appears if not already enabled).
37
-
-**From Security AI settings:**
38
-
- Use the global search field to find "AI Assistant for Security".
39
-
- On the **Knowledge Base** tab, click **Setup Knowledge Base**.
40
-
41
-
> _Comment: Confirm if enabling from the conversation is available in all environments or only certain versions._
42
-
43
-
## Step 2: Configure Alert Context
44
-
45
-
- AI Assistant can use up to N (configurable, up to 500) open or acknowledged alerts from the last 24 hours as context.
46
-
- Use the slider in the Knowledge Base tab to select how many alerts to include.
47
-
- Alerts are ordered by risk score and recency; building block alerts are excluded.
48
-
49
-
> _Comment: Confirm maximum number of alerts supported for context (docs mention up to 500, but token limits may apply)._
17
+
Before following this guide, review the [Knowlege Base](/solutions/security/ai/ai-assistant-knowledge-base.md) topic for general information and prerequisites, and [enable knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md#enable-knowledge-base).
50
18
51
19
## Step 3: Add Knowledge Sources
52
20
@@ -96,6 +64,6 @@ AI Assistant Knowledge Base feature lets you provide custom, organization-specif
96
64
97
65
## Additional Resources
98
66
99
-
-[AI Assistant Knowledge Base documentation](https://www.elastic.co/guide/en/security/current/ai-assistant-knowledge-base.html)
0 commit comments