You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/serverless/AI-for-security/attack-discovery.mdx
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ When you access Attack discovery for the first time, you'll need to select an LL
38
38
2. Select an existing connector from the dropdown menu, or add a new one.
39
39
40
40
<DocCallOuttitle="Recommended models">
41
-
While Attack discovery is compatible with many different models, refer to the <DocLinkslug="/serverless/security/llm-performance-matrix"> Large language model performance matrix </DocLink> to see which models perform best.
41
+
While Attack discovery is compatible with many different models, our testing found increased performance with Claude 3.5 Sonnet. In general, models with larger context windows are more effective for Attack discovery.
@@ -54,6 +54,7 @@ Attack discovery is in technical preview and will only analyze opened and acknow
54
54

55
55
56
56
57
+
57
58
<DocCallOuttitle="Important">
58
59
Attack discovery uses the same data anonymization settings as <DocLinkslug="/serverless/security/ai-assistant">Elastic AI Assistant</DocLink>. To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
59
60
</DocCallOut>
@@ -69,7 +70,7 @@ Each discovery includes the following information describing the potential threa
69
70
- The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to.
70
71
- The implicated entities (users and hosts), and what suspicious activity was observed for each.
0 commit comments