Skip to content

[Security Solution] [AI assistant] Security labs content package spec #900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

[Security Solution] [AI assistant] Security labs content package spec #900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d88443
Security labs content package spec
KDKHD May 22, 2025
9e1fb99
changelog
KDKHD May 22, 2025
a2110b9
test
KDKHD May 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions spec/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@
- description: Add kibana/security_ai_prompt to support security AI prompt assets.
type: enhancement
link: https://github.com/elastic/package-spec/pull/871
- description: Add kibana/security_labs_content to support Security Labs assets.
type: enhancement
link: https://github.com/elastic/package-spec/pull/871
- version: 3.3.6-next
changes:
- description: Add support for _dev/shared folder.
Expand Down
9 changes: 9 additions & 0 deletions spec/content/kibana/spec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,15 @@ spec:
type: file
contentMediaType: "application/json"
pattern: '^{PACKAGE_NAME}-.+\.json$'
- description: Folder containing security Security Labs assets
type: folder
name: "security_labs_content"
required: false
contents:
- description: A Security Labs asset
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please provide a more detailed description about what is a security labs asset.

type: file
contentMediaType: "application/json"
pattern: '^{PACKAGE_NAME}-.+\.json$'
- description: Folder containing rules
type: folder
name: "security_rule"
Expand Down
24 changes: 24 additions & 0 deletions ...kages/good_content/kibana/security_labs_content/good_content-security_labs_content_1.json
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This document seems to contain duplicate data. Maybe the document could be stored as more human-friendly YAML format here, without duplicate data, and Fleet would handle its adaptation to this JSON format.

Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
{
"attributes": {
"raw": {
"document": "---\ntitle: \"2022 Elastic Global Threat Report Announcement\"\nslug: \"2022-elastic-global-threat-report-announcement\"\ndate: \"2022-11-30\"\ndescription: \"Discover our latest findings & strategic recommendations to better stay informed of potential directions threat actors may focus on.\"\nauthor:\n - slug: devon-kerr\nimage: \"gtr-blog-image-720x420.jpg\"\ncategory:\n - slug: reports\n---\n\nToday Elastic Security Labs celebrates another milestone: launching the [2022 Elastic Global Threat Report](https://www.elastic.co/explore/security-without-limits/global-threat-report), our inaugural summary of threat trends, forecasts, and recommendations. We analyzed millions of telemetry events from sources around the world to share these insights with you; all part of our continued commitment to transparency, and our mission to protect the world's data.\n\nYou can find the report [here](https://www.elastic.co/explore/security-without-limits/global-threat-report), we're excited to share it with you.\n"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these assets always text documentation? Or can they also contain images or some other static content?

},
"title": "2022 Elastic Global Threat Report Announcement",
"slug": "2022-elastic-global-threat-report-announcement",
"date": "2022-11-30",
"description": "Discover our latest findings & strategic recommendations to better stay informed of potential directions threat actors may focus on.",
"author": [
{
"slug": "devon-kerr"
}
],
"image": "gtr-blog-image-720x420.jpg",
"category": [
{
"slug": "reports"
}
]
},
"id": "good_content-security_labs_content_1",
"type": "security_labs_content"
}