Skip to content

Commit 9ff1295

Browse files
committed
removes serverless updates due to infra changes
1 parent d2e9d6a commit 9ff1295

File tree

4 files changed

+3
-2
lines changed

4 files changed

+3
-2
lines changed

docs/serverless/AI-for-security/attack-discovery.mdx

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ When you access Attack discovery for the first time, you'll need to select an LL
3838
2. Select an existing connector from the dropdown menu, or add a new one.
3939

4040
<DocCallOut title="Recommended models">
41-
While Attack discovery is compatible with many different models, refer to the <DocLink slug="/serverless/security/llm-performance-matrix"> Large language model performance matrix </DocLink> to see which models perform best.
41+
While Attack discovery is compatible with many different models, our testing found increased performance with Claude 3.5 Sonnet. In general, models with larger context windows are more effective for Attack discovery.
4242
</DocCallOut>
4343

4444
![Attack discovery empty state](../images/attack-discovery/attck-disc-select-model-empty-state.png)
@@ -54,6 +54,7 @@ Attack discovery is in technical preview and will only analyze opened and acknow
5454
![AI Assistant knowledge base menu](../images/attack-discovery/attck-disc-alerts-number-menu.png)
5555

5656

57+
5758
<DocCallOut title="Important">
5859
Attack discovery uses the same data anonymization settings as <DocLink slug="/serverless/security/ai-assistant">Elastic AI Assistant</DocLink>. To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
5960
</DocCallOut>
@@ -69,7 +70,7 @@ Each discovery includes the following information describing the potential threa
6970
- The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to.
7071
- The implicated entities (users and hosts), and what suspicious activity was observed for each.
7172

72-
![Attack discovery detail view](../images/attack-discovery/attck-disc-example-disc.png)
73+
![Attack discovery detail view](../images/attack-discovery/attack-discovery-full-card.png)
7374

7475
<div id="workflows"></div>
7576
## Incorporate discoveries with other workflows
Binary file not shown.
222 KB
Loading
Binary file not shown.

0 commit comments

Comments
 (0)