[9.2] [Security Assistant] Prioritize connector defaultModel over stored conversation model (#237947) (#239239)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Security Assistant] Prioritize connector defaultModel over stored
conversation model
(#237947)](#237947)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-10-15T20:35:58Z","message":"[Security
Assistant] Prioritize connector defaultModel over stored conversation
model (#237947)\n\n### Summary\nWhen a connector's `defaultModel` is
updated, existing conversations now\nuse the updated model instead of
the stale model stored in the\nconversation's
`apiConfig`.\n\nChanges:\n- Modified `assistant/api/index.tsx` to no
longer send `model` from the\nconversation\n- Modified
`default_assistant_graph/index.ts` to send the connector's\ndefault
model if `undefined`. This is for ActionsClient only, as\nInferenceChat
falls back to the connector default appropriately.\n- Modified
`getConversationApiConfig` to prioritize connectorModel over\nstored
model\n- Added tests to verify connector model takes precedence\n- Added
fallback test when connector has no model\n\n\nThis ensures
conversations always use the latest connector\nconfiguration, fixing the
issue where OpenAI connectors with 'Other'\nprovider would not pick up
modelId changes for existing conversations.\n\n### Testing Instructions
for PR\n1. Create OpenAI connector with modelId \"model-v1\"\n2. Create
conversation and send message\n3. Update connector modelId to
\"model-v2\"\n4. Return to conversation and send another message\n5.
Verify request is fulfilled with new model\n\nCreated with Cursor and
Claude 4.5 Sonnet\n\n### Release Notes\nPrioritize connector
defaultModel over stored conversation model\n\n### Checklist\n\n- [X]
[Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [X] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"e5ec416caaa3c33219c05eaf28854098852fc870","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","sdh-linked","Feature:Security
Assistant","Team:Security Generative
AI","backport:version","v9.1.0","v8.19.0","v9.2.0","v9.3.0"],"title":"[Security
Assistant] Prioritize connector defaultModel over stored conversation
model","number":237947,"url":"https://github.com/elastic/kibana/pull/237947","mergeCommit":{"message":"[Security
Assistant] Prioritize connector defaultModel over stored conversation
model (#237947)\n\n### Summary\nWhen a connector's `defaultModel` is
updated, existing conversations now\nuse the updated model instead of
the stale model stored in the\nconversation's
`apiConfig`.\n\nChanges:\n- Modified `assistant/api/index.tsx` to no
longer send `model` from the\nconversation\n- Modified
`default_assistant_graph/index.ts` to send the connector's\ndefault
model if `undefined`. This is for ActionsClient only, as\nInferenceChat
falls back to the connector default appropriately.\n- Modified
`getConversationApiConfig` to prioritize connectorModel over\nstored
model\n- Added tests to verify connector model takes precedence\n- Added
fallback test when connector has no model\n\n\nThis ensures
conversations always use the latest connector\nconfiguration, fixing the
issue where OpenAI connectors with 'Other'\nprovider would not pick up
modelId changes for existing conversations.\n\n### Testing Instructions
for PR\n1. Create OpenAI connector with modelId \"model-v1\"\n2. Create
conversation and send message\n3. Update connector modelId to
\"model-v2\"\n4. Return to conversation and send another message\n5.
Verify request is fulfilled with new model\n\nCreated with Cursor and
Claude 4.5 Sonnet\n\n### Release Notes\nPrioritize connector
defaultModel over stored conversation model\n\n### Checklist\n\n- [X]
[Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [X] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"e5ec416caaa3c33219c05eaf28854098852fc870"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.2"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/237947","number":237947,"mergeCommit":{"message":"[Security
Assistant] Prioritize connector defaultModel over stored conversation
model (#237947)\n\n### Summary\nWhen a connector's `defaultModel` is
updated, existing conversations now\nuse the updated model instead of
the stale model stored in the\nconversation's
`apiConfig`.\n\nChanges:\n- Modified `assistant/api/index.tsx` to no
longer send `model` from the\nconversation\n- Modified
`default_assistant_graph/index.ts` to send the connector's\ndefault
model if `undefined`. This is for ActionsClient only, as\nInferenceChat
falls back to the connector default appropriately.\n- Modified
`getConversationApiConfig` to prioritize connectorModel over\nstored
model\n- Added tests to verify connector model takes precedence\n- Added
fallback test when connector has no model\n\n\nThis ensures
conversations always use the latest connector\nconfiguration, fixing the
issue where OpenAI connectors with 'Other'\nprovider would not pick up
modelId changes for existing conversations.\n\n### Testing Instructions
for PR\n1. Create OpenAI connector with modelId \"model-v1\"\n2. Create
conversation and send message\n3. Update connector modelId to
\"model-v2\"\n4. Return to conversation and send another message\n5.
Verify request is fulfilled with new model\n\nCreated with Cursor and
Claude 4.5 Sonnet\n\n### Release Notes\nPrioritize connector
defaultModel over stored conversation model\n\n### Checklist\n\n- [X]
[Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [X] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"e5ec416caaa3c33219c05eaf28854098852fc870"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <[email protected]>

Author: kibanamachine

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/index.test.tsx

@@ -79,7 +79,7 @@ describe('API tests', () => {
         '/internal/elastic_assistant/actions/connector/foo/_execute',
         {
           ...staticDefaults,
-          body: '{"model":"gpt-4","message":"This is a test","subAction":"invokeAI","conversationId":"test","actionTypeId":".gen-ai","replacements":{},"screenContext":{"timeZone":"America/New_York"}}',
+          body: '{"message":"This is a test","subAction":"invokeAI","conversationId":"test","actionTypeId":".gen-ai","replacements":{},"screenContext":{"timeZone":"America/New_York"}}',
         }
       );
     });
@@ -91,7 +91,7 @@ describe('API tests', () => {
         '/internal/elastic_assistant/actions/connector/foo/_execute',
         {
           ...streamingDefaults,
-          body: '{"model":"gpt-4","message":"This is a test","subAction":"invokeStream","conversationId":"test","actionTypeId":".gen-ai","replacements":{},"screenContext":{"timeZone":"America/New_York"}}',
+          body: '{"message":"This is a test","subAction":"invokeStream","conversationId":"test","actionTypeId":".gen-ai","replacements":{},"screenContext":{"timeZone":"America/New_York"}}',
         }
       );
     });
@@ -164,7 +164,7 @@ describe('API tests', () => {
         '/internal/elastic_assistant/actions/connector/foo/_execute',
         {
           ...staticDefaults,
-          body: '{"model":"gpt-4","message":"This is a test","subAction":"invokeAI","conversationId":"test","actionTypeId":".gen-ai","replacements":{"auuid":"real.hostname"},"screenContext":{"timeZone":"America/New_York"},"alertsIndexPattern":".alerts-security.alerts-default","size":30}',
+          body: '{"message":"This is a test","subAction":"invokeAI","conversationId":"test","actionTypeId":".gen-ai","replacements":{"auuid":"real.hostname"},"screenContext":{"timeZone":"America/New_York"},"alertsIndexPattern":".alerts-security.alerts-default","size":30}',
         }
       );
     });

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/api/index.tsx

@@ -68,7 +68,6 @@ export const fetchConnectorExecuteAction = async ({
   });
 
   const requestBody = {
-    model: apiConfig?.model,
     message,
     subAction: isStream ? 'invokeStream' : 'invokeAI',
     conversationId,

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/use_conversation/helpers.test.ts

@@ -347,5 +347,55 @@ describe('useConversation helpers', () => {
         },
       });
     });
+
+    test('should prioritize connector defaultModel over stored conversation model', () => {
+      const connectorsWithModel: AIConnector[] = [
+        {
+          id: '123',
+          actionTypeId: '.gen-ai',
+          apiProvider: OpenAiProviderType.OpenAi,
+          config: {
+            provider: OpenAiProviderType.OpenAi,
+            defaultModel: 'gpt-4-turbo',
+          },
+        },
+      ] as unknown as AIConnector[];
+
+      const result = getConversationApiConfig({
+        allSystemPrompts,
+        conversation, // has stored model: 'gpt-3'
+        connectors: connectorsWithModel,
+        defaultConnector,
+      });
+
+      expect(result).toEqual({
+        apiConfig: {
+          connectorId: '123',
+          actionTypeId: '.gen-ai',
+          provider: OpenAiProviderType.OpenAi,
+          defaultSystemPromptId: '2',
+          model: 'gpt-4-turbo', // Should use connector's defaultModel, not conversation's stored 'gpt-3'
+        },
+      });
+    });
+
+    test('should fall back to stored conversation model when connector has no defaultModel', () => {
+      const result = getConversationApiConfig({
+        allSystemPrompts,
+        conversation, // has stored model: 'gpt-3'
+        connectors, // connectors have no defaultModel set
+        defaultConnector,
+      });
+
+      expect(result).toEqual({
+        apiConfig: {
+          connectorId: '123',
+          actionTypeId: '.gen-ai',
+          provider: OpenAiProviderType.OpenAi,
+          defaultSystemPromptId: '2',
+          model: 'gpt-3', // Should fall back to conversation's stored model
+        },
+      });
+    });
   });
 });

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/assistant/use_conversation/helpers.ts

@@ -133,7 +133,7 @@ export const getConversationApiConfig = ({
           actionTypeId: connector.actionTypeId,
           provider: connector.apiProvider ?? connectorApiProvider,
           defaultSystemPromptId: defaultSystemPrompt?.id,
-          model: conversation?.apiConfig?.model ?? connectorModel,
+          model: connectorModel ?? conversation?.apiConfig?.model,
         },
       }
     : ({

x-pack/solutions/security/plugins/elastic_assistant/server/lib/langchain/graphs/default_assistant_graph/index.ts

@@ -76,8 +76,10 @@ export const callAssistantGraph: AgentExecutor<true | false> = async ({
    * creating a new instance, we prevent other uses of llm from binding and changing
    * the state unintentionally. For this reason, only call createLlmInstance at runtime
    */
-  const createLlmInstance = async () =>
-    !inferenceChatModelDisabled
+  const createLlmInstance = async () => {
+    const connector = await actionsClient.get({ id: connectorId });
+    const defaultModel = connector?.config?.defaultModel;
+    return !inferenceChatModelDisabled
       ? inference.getChatModel({
           request,
           connectorId,
@@ -102,7 +104,7 @@ export const callAssistantGraph: AgentExecutor<true | false> = async ({
           logger,
           // possible client model override,
           // let this be undefined otherwise so the connector handles the model
-          model: request.body.model,
+          model: request.body.model ?? defaultModel,
           // ensure this is defined because we default to it in the language_models
           // This is where the LangSmith logs (Metadata > Invocation Params) are set
           temperature: getDefaultArguments(llmType).temperature,
@@ -117,6 +119,7 @@ export const callAssistantGraph: AgentExecutor<true | false> = async ({
             pluginId: 'security_ai_assistant',
           },
         });
+  };
 
   const anonymizationFieldsRes =
     await dataClients?.anonymizationFieldsDataClient?.findDocuments<EsAnonymizationFieldsSchema>({