Skip to content

Commit 75783a2

Browse files
benironsidemdbirnstiehlstephmilovicdhru42natasha-moore-elastic
authored
AI Assistant chat sharing (#2903)
Fixes #2815 by documenting chat sharing for AI Assistant. Related Kibana PR: elastic/kibana#230614 --------- Co-authored-by: Mike Birnstiehl <[email protected]> Co-authored-by: Steph Milovic <[email protected]> Co-authored-by: Dhrumil Patel <[email protected]> Co-authored-by: natasha-moore-elastic <[email protected]>
1 parent 27a5240 commit 75783a2

File tree

4 files changed

+243
-5
lines changed

4 files changed

+243
-5
lines changed

‎solutions/images/ai-assistant-shared-status-badge.png‎

166 KB
Loading

‎solutions/images/security-ai-assistant-chat-options-menu.png‎

82 KB
Loading

‎solutions/images/security-ai-assistant-settings-menu.png‎

208 KB
Loading

‎solutions/security/ai/ai-assistant.md‎

Lines changed: 243 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,28 +112,266 @@ Be sure to specify which language you’d like AI Assistant to use when writing
112112
AI Assistant can remember particular information you tell it to remember. For example, you could tell it: "When anwering any question about srv-win-s1-rsa or an alert that references it, mention that this host is in the New York data center". This will cause it to remember the detail you highlighted.
113113
::::
114114

115+
## Share conversations
116+
117+
```{applies_to}
118+
stack: ga 9.2
119+
serverless: ga
120+
```
121+
122+
Conversations that you start with AI Assistant are private by default and not visible to other members of your team. You have two ways to share conversations - either with selected members or more broadly to everyone with access to the space.
123+
124+
To share a conversation, do one of the following:
125+
126+
- Click the **Private** / **Shared** / **Restricted** badge next to the conversation's title. Use the dropdown menu to define the chat's visibility. If you select **Restricted**, a modal appears where you can select which users have access.
127+
::::{image} /solutions/images/ai-assistant-shared-status-badge.png
128+
:alt: AI Assistant chat with the sharing status dropdown open
129+
:screenshot:
130+
::::
131+
- Go to **AI Assistant settings -> Conversations** to view all conversations you've started. Update their visibility as desired.
132+
133+
134+
Once a conversation is shared, you can copy its URL to easily link it to your team:
135+
136+
- Open an AI Assistant chat, open the **Conversation settings** menu and select **Copy URL**.
137+
- Open the **Conversations** tab of the AI Assistant settings page, then select the one you want to share and click **Copy URL**.
138+
139+
When someone shares a chat with you, you can review it but can't continue the conversation, since it is owned by another user. However, you can duplicate a shared conversation and continue where your colleague left off. To duplicate a shared conversation:
140+
141+
- Open an AI Assistant chat, open the **Conversation settings** menu and select **Duplicate**.
142+
- Open the **Conversations** tab of the AI Assistant settings page, then select the one you want to duplicate and click **Duplicate**.
143+
144+
There are several [audit events](kibana://reference/kibana-audit-events.md) related to conversation sharing. Click each title to show an example:
145+
146+
:::{dropdown} 1. security_assistant_conversation_shared
147+
```
148+
{
149+
"event": {
150+
"action": "security_assistant_conversation_shared",
151+
"category": [
152+
"database"
153+
],
154+
"type": [
155+
"change"
156+
],
157+
"outcome": "success"
158+
},
159+
"user": {
160+
"id": "u_xSVO6jcSCvoEcle7e3XVVfBU4Swm1R8-x7pi5bxrSvU_0",
161+
"name": "test_daija_glover",
162+
"roles": [
163+
"superuser"
164+
]
165+
},
166+
"kibana": {
167+
"space_id": "default",
168+
"session_id": "1AZ8kfSYHzVO5ZMZ97DrNi1wjN6BFKHTw75KH8WiF7w="
169+
},
170+
"trace": {
171+
"id": "7e080b32-41b4-453b-80fe-b9c1e12a1c57"
172+
},
173+
"client": {
174+
"ip": "127.0.0.1"
175+
},
176+
"http": {
177+
"request": {
178+
"headers": {
179+
"x-forwarded-for": "127.0.0.1"
180+
}
181+
}
182+
},
183+
"service": {
184+
"node": {
185+
"roles": [
186+
"background_tasks",
187+
"ui"
188+
]
189+
}
190+
},
191+
"ecs": {
192+
"version": "9.0.0"
193+
},
194+
"@timestamp": "2025-08-26T13:16:10.422-06:00",
195+
"message": "User has shared conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"] to all users in the space",
196+
"log": {
197+
"level": "INFO",
198+
"logger": "plugins.security.audit.ecs"
199+
},
200+
"process": {
201+
"pid": 61536,
202+
"uptime": 65.705743792
203+
},
204+
"span": {
205+
"id": "8364fa9bf07311d6"
206+
}
207+
}
208+
```
209+
:::
210+
211+
:::{dropdown} 2. security_assistant_conversation_private
212+
```
213+
{
214+
"event": {
215+
"action": "security_assistant_conversation_private",
216+
"category": [
217+
"database"
218+
],
219+
"type": [
220+
"change"
221+
],
222+
"outcome": "success"
223+
},
224+
"user": {
225+
"id": "u_xSVO6jcSCvoEcle7e3XVVfBU4Swm1R8-x7pi5bxrSvU_0",
226+
"name": "test_daija_glover",
227+
"roles": [
228+
"superuser"
229+
]
230+
},
231+
"kibana": {
232+
"space_id": "default",
233+
"session_id": "1AZ8kfSYHzVO5ZMZ97DrNi1wjN6BFKHTw75KH8WiF7w="
234+
},
235+
"trace": {
236+
"id": "ae998403-8453-44ae-a9b8-ac8002c3bf28"
237+
},
238+
"client": {
239+
"ip": "127.0.0.1"
240+
},
241+
"http": {
242+
"request": {
243+
"headers": {
244+
"x-forwarded-for": "127.0.0.1"
245+
}
246+
}
247+
},
248+
"service": {
249+
"node": {
250+
"roles": [
251+
"background_tasks",
252+
"ui"
253+
]
254+
}
255+
},
256+
"ecs": {
257+
"version": "9.0.0"
258+
},
259+
"@timestamp": "2025-08-26T13:15:46.300-06:00",
260+
"message": "User has made private conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"]",
261+
"log": {
262+
"level": "INFO",
263+
"logger": "plugins.security.audit.ecs"
264+
},
265+
"process": {
266+
"pid": 61536,
267+
"uptime": 41.582780958
268+
},
269+
"span": {
270+
"id": "68a0d5f52faa17d4"
271+
}
272+
}
273+
```
274+
:::
275+
276+
:::{dropdown} 3. security_assistant_conversation_restricted
277+
```
278+
{
279+
"event": {
280+
"action": "security_assistant_conversation_restricted",
281+
"category": [
282+
"database"
283+
],
284+
"type": [
285+
"change"
286+
],
287+
"outcome": "success"
288+
},
289+
"user": {
290+
"id": "u_xSVO6jcSCvoEcle7e3XVVfBU4Swm1R8-x7pi5bxrSvU_0",
291+
"name": "test_daija_glover",
292+
"roles": [
293+
"superuser"
294+
]
295+
},
296+
"kibana": {
297+
"space_id": "default",
298+
"session_id": "1AZ8kfSYHzVO5ZMZ97DrNi1wjN6BFKHTw75KH8WiF7w="
299+
},
300+
"trace": {
301+
"id": "b59f9790-87ff-45f0-b28e-1d9ffa6cfb09"
302+
},
303+
"client": {
304+
"ip": "127.0.0.1"
305+
},
306+
"http": {
307+
"request": {
308+
"headers": {
309+
"x-forwarded-for": "127.0.0.1"
310+
}
311+
}
312+
},
313+
"service": {
314+
"node": {
315+
"roles": [
316+
"background_tasks",
317+
"ui"
318+
]
319+
}
320+
},
321+
"ecs": {
322+
"version": "9.0.0"
323+
},
324+
"@timestamp": "2025-08-26T14:40:59.897-06:00",
325+
"message": "User has restricted conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"] to user ([id=u_LdnmWaOWbWS1ObwqRW2MLWMkWtxCSyiElishzEpew0g_0, name=test_dina_bahringer])",
326+
"log": {
327+
"level": "INFO",
328+
"logger": "plugins.security.audit.ecs"
329+
},
330+
"process": {
331+
"pid": 77921,
332+
"uptime": 29.727069625
333+
},
334+
"span": {
335+
"id": "80e57252aceea924"
336+
}
337+
}
338+
```
339+
:::
340+
115341
## Configure AI Assistant [configure-ai-assistant]
116342

117-
To adjust AI Assistant's settings from the chat window, click the **More** (three dots) button in the upper-right.
343+
To adjust general AI Assistant settings from the chat window, click the **Assistant settings menu** button in the upper-right.
118344

119-
::::{image} /solutions/images/security-attack-discovery-more-popover.png
120-
:alt: AI Assistant's more options popover
345+
::::{image} /solutions/images/security-ai-assistant-settings-menu.png
346+
:alt: AI Assistant's settings popover
121347
:screenshot:
122348
::::
123349

124-
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Chat options** affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the [knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md), and content from Elastic's Security Labs and [product documentation](/solutions/security/ai/ai-assistant-knowledge-base.md#elastic-docs).
350+
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Alerts to analyze** button allows you to adjust how many alerts to include as context for your conversation.
125351

126352
The **Security AI settings** page provides a range of configuration options for AI Assistant. To access it directly, use the global search field to search for "AI Assistant for Security".
127353

128354
It has the following tabs:
129355

130-
* **Conversations:** When you open AI Assistant from certain pages, such as **Alerts**, it defaults to the relevant conversation type. For each conversation type, choose the default System Prompt, the default connector, and the default model (if applicable). The **Streaming** setting controls whether AI Assistant’s responses appear word-by-word (streamed), or as a complete block of text. Streaming is currently only available for OpenAI models.
356+
* **Conversations:** The **Streaming** setting controls whether AI Assistant’s responses appear word-by-word (streamed), or as a complete block of text. After the streaming setting is a list of all saved conversations. From here you can change their visibility, system prompt, and connector.
131357
* **Connectors:** Manage all LLM connectors.
132358
* **System Prompts:** Edit existing System Prompts or create new ones. To create a new System Prompt, type a unique name in the **Name** field, then press **enter**. Under **Prompt**, enter or update the System Prompt’s text. Under **Contexts**, select where the System Prompt should appear.
133359
* **Quick Prompts:** Modify existing Quick Prompts or create new ones. To create a new Quick Prompt, type a unique name in the **Name** field, then press **enter**. Under **Prompt**, enter or update the Quick Prompt’s text.
134360
* **Anonymization:** Select fields to include as plaintext, to obfuscate, and to not send when you provide events to AI Assistant as context. [Learn more](/solutions/security/ai/ai-assistant.md#ai-assistant-anonymization).
135361
* **Knowledge base:** Provide additional context to AI Assistant. [Learn more](/solutions/security/ai/ai-assistant-knowledge-base.md).
136362

363+
364+
To adjust the settings for a specific chat, click the **Conversation settings** button in the upper-right of its chat window.
365+
366+
::::{image} /solutions/images/security-ai-assistant-chat-options-menu.png
367+
:alt: AI Assistant's chat options menu
368+
:screenshot:
369+
::::
370+
371+
The **Copy URL** and **Duplicate** options allow you to share conversations (by sending their URL) and to continue conversations that were shared with you (by duplicating them). The **Delete** option appears for the conversation owner only and allows you to remove a saved conversation.
372+
373+
Settings in the **Chat options** section affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the [knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md), and content from Elastic's Security Labs and [product documentation](/solutions/security/ai/ai-assistant-knowledge-base.md#elastic-docs).
374+
137375
### Anonymization [ai-assistant-anonymization]
138376

139377
::::{admonition} Requirements

0 commit comments

Comments
 (0)