Creates a page summarizing all Elastic's AI-powered features #3768
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,201 @@ | ||||||
| --- | ||||||
| navigation_title: AI-powered features | ||||||
| applies_to: | ||||||
| stack: ga | ||||||
| serverless: ga | ||||||
| products: | ||||||
| - id: kibana | ||||||
| - id: observability | ||||||
| - id: security | ||||||
| - id: cloud-serverless | ||||||
| --- | ||||||
|
|
||||||
| # AI-powered features | ||||||
|
|
||||||
| AI is built into many parts of the {{stack}}. This page describes Elastic's AI-powered features, organized by solution, and provides links to more detailed information about each of them. | ||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
Slightly rewording to not sound like we "just" added a layer of AI tools on top of our products. |
||||||
|
|
||||||
| To learn about enabling and disabling these features in your deployment, refer to [](/explore-analyze/ai-features/manage-access-to-ai-assistant.md). | ||||||
|
|
||||||
| For pricing information, refer to [pricing](https://www.elastic.co/pricing). | ||||||
|
|
||||||
| ## Requirements | ||||||
|
|
||||||
| - To use Elastic's AI-powered features, you need an appropriate license and feature tier. These vary by solution and feature. Refer to each feature's documentation to learn more. | ||||||
| - Most features require at least one working LLM connector. To learn about setting up large language model (LLM) connectors used by AI-powered features, refer to [](/solutions/security/ai/set-up-connectors-for-large-language-models-llm.md). | ||||||
|
Contributor
There was a problem hiding this comment.
|
||||||
|
|
||||||
| ## AI-powered features on the Elastic platform | ||||||
|
Contributor
There was a problem hiding this comment. Would be nice to have an intro under this title to explain what it means for users to have AI powered features available for the "platform" @szabosteve |
||||||
|
|
||||||
| ### Elastic {{infer-cap}} | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
|
|
||||||
| [Elastic {{infer-cap}}](/explore-analyze/elastic-inference.md) enables you to use {{ml}} or AI models to make predictions or enact operations — such as text embedding, or reranking - on your data. | ||||||
|
|
||||||
| To learn more, refer to: | ||||||
|
|
||||||
| - [Elastic {{infer-cap}} Service (EIS)](/explore-analyze/elastic-inference/eis.md): a managed service that runs {{infer}} outside your cluster resources. | ||||||
| - [The {{infer}} API](/explore-analyze/elastic-inference/inference-api.md): a general-purpose API that enables you to run {{infer}} using EIS, your own models, or third-party services. | ||||||
|
Comment on lines
+28
to
+39
Contributor
There was a problem hiding this comment. @szabosteve Do you think we could introduce the Elastic Managed LLM here? It's missing from this page - In fact, I think I understand this better when I read the 1st paragraph and 1st section of https://www.elastic.co/docs/explore-analyze/elastic-inference/eis than this. Is there a chance we could make those snippets and somehow reuse them? |
||||||
|
|
||||||
| ### Natural language processing | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
| Natural Language Processing (NLP) enables you to analyze natural language data and make predictions. | ||||||
|
|
||||||
| Elastic offers a range of [built-in NLP models](/explore-analyze/machine-learning/nlp/ml-nlp-built-in-models.md) such as the Elastic-trained [ELSER](/explore-analyze/machine-learning/nlp/ml-nlp-elser.md). You can also [deploy custom models](/explore-analyze/machine-learning/nlp/ml-nlp-overview.md). | ||||||
|
Comment on lines
+41
to
+48
Contributor
There was a problem hiding this comment. @szabosteve Should we more explicitly call out "Machine learning" in this section? I'm thinking it may be a little clearer to present this section with something like this? Hi these are AI-powered capabilities or features augmented with AI available to you without requiring a specific solution context:
|
||||||
|
|
||||||
| ## AI-powered features in {{es}} | ||||||
|
Contributor
There was a problem hiding this comment. a small intro to indicate clearly that we're talking about the "solution" context here? #disambiguation @leemthompo |
||||||
|
|
||||||
| ### Agent builder | ||||||
|
Contributor
There was a problem hiding this comment. Soon AB will be everywhere, so we should probably put it in the platform section to be ahead of the game
Contributor
There was a problem hiding this comment. I think we should only move it once it becomes available everywhere
Contributor
There was a problem hiding this comment. Well I guess technically it's available everywhere already apart from serverless security and obs |
||||||
|
|
||||||
| ```{applies_to} | ||||||
| serverless: | ||||||
| elasticsearch: preview | ||||||
| observability: unavailable | ||||||
| security: unavailable | ||||||
| ``` | ||||||
|
|
||||||
| [Agent Builder](/solutions/search/elastic-agent-builder.md) enables you to create AI agents that can interact with your {{es}} data, run queries, and provide intelligent responses. It provides a complete framework for building conversational AI experiences on top of your search infrastructure. | ||||||
|
|
||||||
| ### AI assistant for {{es}} | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
|
|
||||||
| [](/solutions/observability/observability-ai-assistant.md) helps you understand, analyze, and interact with your Elastic data throughout {{kib}}. It provides a chat interface where you can ask questions about the {{stack}} and your data, and provides contextual insights throughout {{kib}} that explain errors and messages and suggest remediation steps. | ||||||
|
|
||||||
| ### AI-powered search | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
|
|
||||||
| [AI-powered search](/solutions/search/ai-search/ai-search.md) helps you find data based on intent and contextual meaning using vector search technology, which uses {{ml}} models to capture meaning in content. | ||||||
|
|
||||||
| Depending on your team's technical expertise and requirements, you can choose from two broad paths: | ||||||
|
|
||||||
| - For a minimal configuration, managed workflow use [semantic_text](https://www.elastic.co/docs/solutions/search/semantic-search/semantic-search-semantic-text) which is the recommended way to perform semantic search. | ||||||
| - For more control over the implementation details, implement dense or sparse [vector search](https://www.elastic.co/docs/solutions/search/vector). | ||||||
|
|
||||||
| ### Hybrid search | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
|
|
||||||
| [Hybrid search](/solutions/search/hybrid-search.md) combines traditional full-text search with AI-powered search for more powerful search experiences that serve a wider range of user needs. | ||||||
|
|
||||||
| ### Playground | ||||||
| ```{applies_to} | ||||||
| stack: preview 9.0, beta 9.1 | ||||||
| serverless: beta | ||||||
| ``` | ||||||
|
|
||||||
| [Playground](/solutions/search/rag/playground.md) enables you to use large language models (LLMs) to understand, explore, and analyze your {{es}} data using retrieval augmented generation (RAG), via a chat interface. Playground is also very useful for testing and debugging your {{es}} queries, using the [retrievers](/solutions/search/retrievers-overview.md) syntax with the `_search` endpoint. | ||||||
|
|
||||||
| ### Model context protocol | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
|
|
||||||
| The [Model Context Protocol (MCP)](/solutions/search/mcp.md) lets you connect AI agents and assistants to your {{es}} data to enable natural language interactions with your indices. | ||||||
|
|
||||||
| ## AI-powered features in {{observability}} | ||||||
|
Contributor
There was a problem hiding this comment. @mdbirnstiehl a quick intro to specify what we mean with this? (That users need to be in a specific Observability solution context). That's maybe more obvious for obs and security, but it's not for the 1st sections (platform and elastcisearch) so we should probably add a little something here too. |
||||||
|
|
||||||
| ### AI assistant for {{observability}} | ||||||
| ```{applies_to} | ||||||
| stack: | ||||||
| serverless: | ||||||
| ``` | ||||||
|
|
||||||
| [](/solutions/observability/observability-ai-assistant.md) helps you understand, analyze, and interact with your Elastic data throughout {{kib}}. It provides a chat interface where you can ask questions about the {{stack}} and your data, and provides [contextual insights](/solutions/observability/observability-ai-assistant.md#obs-ai-prompts) throughout {{kib}} that explain errors and messages and suggest remediation steps. | ||||||
|
|
||||||
| ### Streams | ||||||
| ```{applies_to} | ||||||
| serverless: ga | ||||||
| stack: preview 9.1, ga 9.2 | ||||||
| ``` | ||||||
|
|
||||||
| [Streams](/solutions/observability/streams/streams.md) provides a single, centralized UI within Kibana that streamlines common tasks like extracting fields, setting data retention, and routing data, so you don't need to use multiple applications or manually configure underlying Elasticsearch components. Streams incorporates AI in the following ways: | ||||||
|
|
||||||
| #### Generate significant events with AI | ||||||
| ```{applies_to} | ||||||
| serverless: ga | ||||||
| stack: preview 9.1, ga 9.2 | ||||||
| ``` | ||||||
| [Significant Events](/solutions/observability/streams/management/significant-events.md) periodically runs a query on your stream to find important events. These can include error messages, exceptions, and other relevant log messages. You can use AI to suggest queries based on your data. | ||||||
|
|
||||||
| #### Generate Grok patterns | ||||||
| ```{applies_to} | ||||||
| serverless: ga | ||||||
| stack: preview 9.1, ga 9.2 | ||||||
| ``` | ||||||
| You can [generate Grok patterns](/solutions/observability/streams/management/extract/grok.md#streams-grok-patterns) to parse your data using AI instead of writing them by hand. | ||||||
|
|
||||||
| #### Generate partition suggestions | ||||||
| ```{applies_to} | ||||||
| serverless: preview | ||||||
| stack: preview 9.2 | ||||||
| ``` | ||||||
| [Partitioning](/solutions/observability/streams/management/partitioning.md) helps you organize log data into meaningful child streams within a wired stream. You can let AI suggest logical groupings based on your data, which you can review and accept. | ||||||
|
|
||||||
| #### Generate stream descriptions and feature identification | ||||||
| ```{applies_to} | ||||||
| serverless: ga | ||||||
| stack: preview 9.1, ga 9.2 | ||||||
| ``` | ||||||
| On the Streams [advanced settings](/solutions/observability/streams/management/advanced.md) tab, you can use AI to generate your [stream description](/solutions/observability/streams/management/advanced.md#streams-advanced-description) and [feature identification](/solutions/observability/streams/management/advanced.md#streams-advanced-features) that AI features like significant events use when generating suggestions. | ||||||
|
|
||||||
florent-leborgne marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
| ## AI-powered features in {{elastic-sec}} | ||||||
|
|
||||||
| ### AI Assistant for Security | ||||||
| ```{applies_to} | ||||||
| stack: all | ||||||
| serverless: | ||||||
| security: all | ||||||
| ``` | ||||||
|
|
||||||
| [Elastic AI Assistant for Security](/solutions/security/ai/ai-assistant.md) helps you interact with your {{elastic-sec}} data and assists with tasks such as alert investigation, incident response, and query generation. It provides a chat interface where you can ask questions about the {{stack}} and your data, and provides contextual insights throughout {{kib}} that explain errors and messages and suggest remediation steps. | ||||||
|
|
||||||
| ### Attack Discovery | ||||||
| ```{applies_to} | ||||||
| stack: ga | ||||||
| serverless: | ||||||
| security: ga | ||||||
| ``` | ||||||
|
|
||||||
| [Attack Discovery](/solutions/security/ai/attack-discovery.md) leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This can help make the most of each security analyst’s time, fight alert fatigue, and reduce your mean time to respond. | ||||||
|
|
||||||
| ### Automatic Migration | ||||||
|
|
||||||
| [Automatic Migration](/solutions/security/get-started/automatic-migration.md) helps you quickly migrate Splunk assets to {{elastic-sec}}. The following asset types are supported: | ||||||
|
|
||||||
| * {applies_to}`stack: preview 9.0, ga 9.1` {applies_to}`serverless: ga` Splunk rules | ||||||
| * {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview` Splunk dashboards | ||||||
|
|
||||||
| ### Automatic Import | ||||||
| ```{applies_to} | ||||||
| stack: ga | ||||||
| serverless: | ||||||
| security: ga | ||||||
| ``` | ||||||
|
|
||||||
| [Automatic Import](/solutions/security/get-started/automatic-import.md) helps you quickly parse, ingest, and create ECS mappings for data from sources that don’t yet have prebuilt Elastic integrations. This can accelerate your migration to {{elastic-sec}}, and help you quickly add new data sources to an existing SIEM solution in {{elastic-sec}}. | ||||||
|
|
||||||
| ### Automatic Troubleshooting | ||||||
| ```{applies_to} | ||||||
| stack: ga 9.2, preview 9.0 | ||||||
| serverless: | ||||||
| security: ga | ||||||
| ``` | ||||||
| [Automatic troubleshooting](/solutions/security/manage-elastic-defend/automatic-troubleshooting.md) helps you identify and resolve issues that could prevent {{elastic-defend}} from working as intended. It provides actionable insights into the following common problem areas: | ||||||
|
|
||||||
|
|
||||||
| * {applies_to}`stack: ga 9.2` {applies_to}`serverless: ga` **Policy responses**: Detect warnings or failures in {{elastic-defend}}’s integration policies. | ||||||
| * **Third-party antivirus (AV) software**: Identify installed third-party antivirus (AV) products that may conflict with {{elastic-defend}}. | ||||||
|
|
||||||
| This helps you resolve configuration errors, address incompatibilities, and ensure that your hosts remain protected. | ||||||
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd like this page to serve a clearer role in the narrative and answer the following questions for users:
To slightly shift the narrative of the current page to answer these questions, can we:
Attack Discovery uses the same LLM connectors as AI Assistant. Does this mean that Attack Discovery's AI capabilities rely on your AI Assistant's config?@benironside thank you for kicking off this PR. This is clearly a cross-team effort so if you can look after the Security piece of it on this page, that's great. In the meantime, @mdbirnstiehl @szabosteve @leemthompo can you help make these changes for your respective areas?