You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adds web crawler example to Knowledge Base doc (#6176)
* Adds web crawler example to Knowledge Base doc
* various minor edits
* fixes note bug
* incorporates James feedback
* incorporates Charles' review
* incorporates review
(cherry picked from commit c5b5f65)
=== Option 2: Enable Knowledge Base from the Security AI settings
46
46
47
-
. To open Security AI settings, use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field] to find "AI Assistant for Security."
47
+
. To open **Security AI settings**, use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field] to find "AI Assistant for Security."
48
48
. On the **Knowledge Base** tab, click **Setup Knowledge Base**. If the button doesn't appear, Knowledge Base is already enabled.
49
49
50
50
image::images/knowledge-base-assistant-settings-kb-tab.png[AI Assistant's settings menu open to the Knowledge Base tab]
@@ -57,15 +57,15 @@ When Knowledge Base is enabled, AI Assistant receives `open` or `acknowledged` a
57
57
To enable Knowledge Base for alerts:
58
58
59
59
. Ensure that knowledge base is <<enable-knowledge-base, enabled>>.
60
-
. Use the slider on the Security AI settings' Knowledge Base tab to select the number of alerts to send to AI Assistant. Click **Save**.
60
+
. On the **Security AI settings** page, go to the **Knowledge Base** tab and use the slider to select the number of alerts to send to AI Assistant. Click **Save**.
61
61
62
62
NOTE: Including a large number of alerts may cause your request to exceed the maximum token length of your third-party generative AI provider. If this happens, try selecting a lower number of alerts to send.
63
63
64
64
[discrete]
65
65
[[knowledge-base-add-knowledge]]
66
66
== Add knowledge
67
67
68
-
To view all knowledge base entries, go to the Security AI settings and select the **Knowledge Base** tab. You can add individual documents or entire indices containing multiple documents. Each entry in the Knowledge Base (a document or index) has a **Sharing** setting of `private` or `global`. Private entries apply to the current user only and do not affect other users in the {kib} space, whereas global entries affect all users. Each entry can also have a `Required knowledge` setting, which means it will be included as context for every message sent to AI Assistant.
68
+
To view all knowledge base entries, go to **Security AI settings** and select the **Knowledge Base** tab. You can add individual documents or entire indices containing multiple documents. Each entry in the Knowledge Base (a document or index) has a **Sharing** setting of `private` or `global`. Private entries apply to the current user only and do not affect other users in the {kib} space, whereas global entries affect all users. Each entry can also have a `Required knowledge` setting, which means it will be included as context for every message sent to AI Assistant.
69
69
70
70
NOTE: When you enable Knowledge Base, it comes pre-populated with articles from https://www.elastic.co/security-labs[Elastic Security Labs], current through September 30, 2024, which allows AI Assistant to leverage Elastic's security research during your conversations. This enables it to answer questions such as, “Are there any new tactics used against Windows hosts that I should be aware of when investigating my alerts?”
71
71
@@ -75,7 +75,7 @@ NOTE: When you enable Knowledge Base, it comes pre-populated with articles from
75
75
76
76
Add an individual document to Knowledge Base when you want AI Assistant to remember a specific piece of information.
77
77
78
-
. To open Security AI settings, use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field] to find "AI Assistant for Security." Select the **Knowledge Base** tab.
78
+
. To open **Security AI settings**, use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field] to find "AI Assistant for Security." Select the **Knowledge Base** tab.
79
79
. Click **New → Document** and give it a name.
80
80
. Under **Sharing**, select whether this knowledge should be **Global** or **Private**.
81
81
. Write the knowledge AI Assistant should remember in the **Markdown text** field.
@@ -108,7 +108,7 @@ Add an index as a knowledge source when you want new information added to that i
108
108
109
109
IMPORTANT: Indices added to Knowledge Base must have at least one field mapped as {ref}/semantic-text.html[semantic text].
110
110
111
-
. To open Security AI settings, use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field] to find "AI Assistant for Security." Select the **Knowledge Base** tab.
111
+
. To open **Security AI settings**, use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field] to find "AI Assistant for Security." Select the **Knowledge Base** tab.
112
112
. Click **New → Index**.
113
113
. Name the knowledge source.
114
114
. Under **Sharing**, select whether this knowledge should be **Global** or **Private**.
@@ -136,3 +136,51 @@ Refer to the following video for an example of adding an index to Knowledge Base
136
136
</br>
137
137
++++
138
138
=======
139
+
140
+
[discrete]
141
+
[[knowledge-base-crawler-or-connector]]
142
+
=== Add knowledge with a connector or web crawler
143
+
144
+
You can use an {es} connector or web crawler to create an index that contains data you want to add to Knowledge Base.
145
+
146
+
This section provides an example of adding a threat intelligence feed to Knowledge Base using a web crawler. For more information on adding data to {es} using a connector, refer to {ref}/es-connectors.html[Ingest data with Elastic connectors]. For more information on web crawlers, refer to {enterprise-search-ref}/crawler.html[Elastic web crawler].
147
+
148
+
[discrete]
149
+
==== Use a web crawler to add threat intelligence to Knowledge Base
150
+
151
+
First, you'll need to set up a web crawler to add the desired data to an index, then you'll need to add that index to Knowledge Base.
152
+
153
+
. From the **Search** section of {kib}, find **Web crawlers** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
154
+
. Click **New web crawler**.
155
+
.. Under **Index name**, name the index where the data from your new web crawler will be stored, for example `threat_intelligence_feed_1`. Click **Create index**.
156
+
.. Under **Domain URL**, enter the URL where the web crawler should collect data. Click **Validate Domain** to test it, then **Add domain**.
157
+
. The previous step opens a page with the details of your new index. Go to its **Mappings** tab, then click **Add field**.
158
+
+
159
+
NOTE: Remember, each index added to Knowledge Base must have at least one semantic text field.
160
+
+
161
+
.. Under **Field type**, select `Semantic text`. Under **Select an inference endpoint**, select `elastic-security-ai-assistant-elser2`. Click **Add field**, then **Save mapping**.
162
+
. Go to the **Scheduling** tab. Enable the **Enable recurring crawls with the following schedule** setting, and define your desired schedule.
163
+
. Go to the **Manage Domains** tab. Select the domain associated with your new web crawler, then go the its **Crawl rules** tab and click **Add crawl rule**. For more information, refer to {enterprise-search-ref}/crawler-extraction-rules.html[Web crawler content extraction rules].
164
+
.. Click **Add crawl rule** again. Under **Policy**, select `Disallow`. Under **Rule**, select `Regex`. Under **Path pattern**, enter `.*`. Click **Save**.
165
+
.. Under **Policy**, select `Allow`. Under **Rule**, select `Contains`. Under **Path pattern**, enter your path pattern, for example `threat-intelligence`. Click **Save**. Make sure this rule appears below the rule created in the previous step on the list.
166
+
.. Click **Crawl**, then **Crawl all domains on this index**. A success message appears. The crawl process will take longer for larger data sources. Once it finishes, your new web crawler's index will contain documents provided by the crawler.
167
+
. Finally, follow the instructions to <<knowledge-base-add-knowledge-index, add an index to Knowledge Base>>. Add the index that contains the data from your new web crawler (`threat_intelligence_feed_1` in this example).
168
+
169
+
Your new threat intelligence data is now included in Knowledge Base and can inform AI Assistant's responses.
170
+
171
+
Refer to the following video for an example of creating a web crawler to ingest threat intelligence data and adding it to Knowledge Base.
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?v=4&size=40){kind=avatar}
0 commit comments