You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/AI-for-security/attack-discovery.asciidoc
+25-10Lines changed: 25 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
[[attack-discovery]]
2
2
[chapter]
3
-
= Attack discovery
3
+
= Attack Discovery
4
4
5
5
:frontmatter-description: Accelerate threat identification by triaging alerts with a large language model.
6
6
:frontmatter-tags-products: [security]
@@ -9,7 +9,7 @@
9
9
10
10
preview::["This feature is in technical preview. It may change in the future, and you should exercise caution when using it in production environments. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of GA features."]
11
11
12
-
Attack discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This can help make the most of each security analyst's time, fight alert fatigue, and reduce your mean time to respond.
12
+
Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This can help make the most of each security analyst's time, fight alert fatigue, and reduce your mean time to respond.
13
13
14
14
For a demo, refer to the following video.
15
15
=======
@@ -33,34 +33,49 @@ This page describes:
33
33
* <<attack-discovery-what-info, What information each discovery includes>>
34
34
* <<attack-discovery-workflows, How you can interact with discoveries to enhance {elastic-sec} workflows>>
35
35
36
+
[discrete]
37
+
[[attack-discovery-rbac]]
38
+
== Role-based access control (RBAC) for Attack Discovery
39
+
40
+
The `Attack Discovery: All` privilege allows you to use Attack Discovery.
When you access Attack discovery for the first time, you'll need to select an LLM connector before you can analyze alerts. Attack discovery uses the same LLM connectors as <<security-assistant>>. To get started:
48
+
When you access Attack Discovery for the first time, you'll need to select an LLM connector before you can analyze alerts. Attack Discovery uses the same LLM connectors as <<security-assistant>>. To get started:
41
49
42
-
. Click the **Attack discovery** page from {elastic-sec}'s navigation menu.
50
+
. Click the **Attack Discovery** page from {elastic-sec}'s navigation menu.
43
51
. Select an existing connector from the dropdown menu, or add a new one.
44
52
+
45
53
.Recommended models
46
54
[sidebar]
47
55
--
56
+
<<<<<<< HEAD
48
57
While Attack discovery is compatible with many different models, our testing found increased performance with Claude 3 Sonnet and Claude 3 Opus. In general, models with larger context windows are more effective for Attack discovery.
49
58
--
50
59
+
51
60
image::images/select-model-empty-state.png[]
61
+
=======
62
+
While Attack Discovery is compatible with many different models, refer to the <<llm-performance-matrix, Large language model performance matrix>> to see which models perform best.
63
+
--
64
+
+
65
+
image::images/attck-disc-select-model-empty.png[]
66
+
>>>>>>> 88103ce2 (AD updates for 8.16 (#6114))
52
67
+
53
68
. Once you've selected a connector, click **Generate** to start the analysis.
54
69
55
70
It may take from a few seconds up to several minutes to generate discoveries, depending on the number of alerts and the model you selected.
56
71
57
-
IMPORTANT: Attack discovery is in technical preview and will only analyze opened and acknowleged alerts from the past 24 hours. By default it only analyzes up to 20 alerts within this timeframe, but you can expand this up to 100 by going to **AI Assistant → Settings (image:images/icon-settings.png[Settings icon,17,17]) → Knowledge Base** and updating the **Alerts** setting.
72
+
IMPORTANT: By default, Attack Discovery analyzes up to 100 alerts within this timeframe, but you can expand this up to 500 by clicking the settings icon (image:images/icon-settings.png[Settings icon,17,17]) next to the model selection menu and adjusting the **Alerts** slider. Note that sending more alerts than your chosen LLM can handle may result in an error.
58
73
59
-
image::images/knowledge-base-assistant-settings-kb-tab.png["AI Assistant's settings menu open to the Knowledge Base tab",75%]
IMPORTANT: Attack discovery uses the same data anonymization settings as <<security-assistant, Elastic AI Assistant>>. To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
76
+
IMPORTANT: Attack Discovery uses the same data anonymization settings as <<security-assistant, Elastic AI Assistant>>. To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
62
77
63
-
Once the analysis is complete, any threats it identifies will appear as discoveries. Click each one's title to expand or collapse it. Click **Generate** at any time to start the Attack discovery process again with the most current alerts.
78
+
Once the analysis is complete, any threats it identifies will appear as discoveries. Click each one's title to expand or collapse it. Click **Generate** at any time to start the Attack Discovery process again with the most current alerts.
64
79
65
80
[[attack-discovery-what-info]]
66
81
[discrete]
@@ -72,7 +87,7 @@ Each discovery includes the following information describing the potential threa
72
87
. The number of associated alerts and which parts of the https://attack.mitre.org/[MITRE ATT&CK matrix] they correspond to.
73
88
. The implicated entities (users and hosts), and what suspicious activity was observed for each.
@@ -86,4 +101,4 @@ There are several ways you can incorporate discoveries into your {elastic-sec} w
86
101
* Click **Investigate in timeline** to explore the discovery in <<timelines-ui, Timeline>>.
87
102
* Click **View in AI Assistant** to attach the discovery to a conversation with AI Assistant. You can then ask follow-up questions about the discovery or associated alerts.
88
103
89
-
image::images/add-discovery-to-assistant.gif[Attack discovery view in AI Assistant]
104
+
image::images/add-discovery-to-assistant.gif[Attack Discovery view in AI Assistant]
Copy file name to clipboardExpand all lines: docs/AI-for-security/usecase-alert-triage.asciidoc
+1-17Lines changed: 1 addition & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,26 +9,10 @@ To enable AI Assistant to answer questions about alerts, you need to provide ale
9
9
[[ai-assistant-triage-alerts-knowledge-base]]
10
10
[discrete]
11
11
== Use AI Assistant to triage multiple alerts
12
-
Enable the <<ai-assistant-knowledge-base, Knowledge Base>> **Alerts** setting to send AI Assistant data for up to 500 alerts as context for each of your prompts. With this setting enabled, you can ask AI Assistant questions such as "How many alerts are present in my environment?", "What are my most urgent alerts?", "Which alerts should I triage first?", "Do any of the alerts in my environment indicate data exfiltration from a Windows machine?", and more.
12
+
Enable the <<ai-assistant-knowledge-base, Knowledge Base>> **Alerts** setting to send AI Assistant data for up to 500 alerts as context for each of your prompts. Use the slider on the Security AI settings' **Knowledge Base** tab to select the number of alerts to send to AI Assistant.
13
13
14
14
For more information, refer to <<ai-assistant-knowledge-base, Knowledge Base>>.
15
15
16
-
For a demo of AI Assistant's alert triage capabilities, refer to the following video.
// :description: Elastic AI Assistant can help you enhance and streamline your alert triage workflows.
5
+
// :keywords: security, overview, get-started
6
+
7
+
Elastic AI Assistant can help you enhance and streamline your alert triage workflows by assessing multiple recent alerts in your environment, and helping you interpret an alert and its context.
8
+
9
+
When you view an alert in {elastic-sec}, details such as related documents, hosts, and users appear alongside a synopsis of the events that triggered the alert. This data provides a starting point for understanding a potential threat. AI Assistant can answer questions about this data and offer insights and actionable recommendations to remediate the issue.
10
+
11
+
To enable AI Assistant to answer questions about alerts, you need to provide alert data as context for your prompts. You can either provide multiple alerts using the <<ai-assistant-knowledge-base, Knowledge Base>> feature, or provide individual alerts directly.
12
+
13
+
[[ai-assistant-triage-alerts-knowledge-base]]
14
+
[discrete]
15
+
== Use AI Assistant to triage multiple alerts
16
+
Enable the <<ai-assistant-knowledge-base, Knowledge Base>> **Alerts** setting to send AI Assistant data for up to 500 alerts as context for each of your prompts. Use the slider on the Security AI settings' **Knowledge Base** tab to select the number of alerts to send to AI Assistant.
17
+
18
+
For more information, refer to <<ai-assistant-knowledge-base, Knowledge Base>>.
19
+
20
+
21
+
[discrete]
22
+
[[use-ai-assistant-to-triage-an-alert]]
23
+
== Use AI Assistant to triage a specific alert
24
+
25
+
Once you have chosen an alert to investigate:
26
+
27
+
. Click its **View details** button from the Alerts table.
28
+
. In the alert details flyout, click **Chat** to launch the AI assistant. Data related to the selected alert is automatically added to the prompt.
29
+
. Click **Alert (from summary)** to view which alert fields will be shared with AI Assistant.
30
+
+
31
+
NOTE: For more information about selecting which fields to send, and to learn about anonymizing your data, refer to <<security-ai-assistant, AI Assistant>>.
32
+
+
33
+
. (Optional) Click a quick prompt to use it as a starting point for your query, for example **Alert summarization**. Improve the quality of AI Assistant's response by customizing the prompt and adding detail.
34
+
+
35
+
Once you've submitted your query, AI Assistant will process the information and provide a detailed response. Depending on your prompt and the alert data that you included, its response can include a thorough analysis of the alert that highlights key elements such as the nature of the potential threat, potential impact, and suggested response actions.
36
+
+
37
+
. (Optional) Ask AI Assistant follow-up questions, provide additional information for further analysis, and request clarification. The response is not a static report.
38
+
39
+
[discrete]
40
+
[[generate-triage-reports]]
41
+
== Generate triage reports
42
+
43
+
Elastic AI Assistant can streamline the documentation and report generation process by providing clear records of security incidents, their scope and impact, and your remediation efforts. You can use AI Assistant to create summaries or reports for stakeholders that include key event details, findings, and diagrams. Once the AI Assistant has finished analyzing one or more alerts, you can generate reports by using prompts such as:
44
+
45
+
* “Generate a detailed report about this incident, including timeline, impact analysis, and response actions. Also, include a diagram of events.”
46
+
* “Generate a summary of this incident/alert and include diagrams of events.”
47
+
* “Provide more details on the mitigation strategies used.”
48
+
49
+
After you review the report, click **Add to existing case** at the top of AI Assistant's response. This allows you to save a record of the report and make it available to your team.
50
+
51
+
[role="screenshot"]
52
+
image::images/ai-assistant-alert-triage/ai-triage-add-to-case.png[An AI Assistant dialogue with the add to existing case button highlighted]
You can use {elastic-sec}’s built-in AI tools to speed up your work and augment your team’s capabilities. The pages in this section describe <<security-ai-assistant>>, which answers questions and enhances your workflows throughout Elastic Security, and <<attack-discovery>>, which speeds up the triage process by finding patterns and identifying attacks spanning multiple alerts.
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?v=4&size=40){kind=avatar}
0 commit comments