Skip to content

[Security Solution] [AI assistant] Docs for AI assistant esql generation with self healing #6934

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Aug 12, 2025
Merged

[Security Solution] [AI assistant] Docs for AI assistant esql generation with self healing #6934

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
57e135e
Include in documentation changes to ES|QL generation in the security …
KDKHD Jul 17, 2025
2844427
Update docs/AI-for-security/ai-security-assistant.asciidoc
KDKHD Jul 23, 2025
d5fad6e
Update docs/AI-for-security/ai-security-assistant.asciidoc
KDKHD Aug 4, 2025
9c537cd
Merge branch '8.19' into enhancement/security-esql-with-self-healing
benironside Aug 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/AI-for-security/ai-security-assistant.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,8 @@ The **Knowledge base** tab of the **Security AI settings** page allows you to en

Elastic AI Assistant allows you to take full advantage of the {elastic-sec} platform to improve your security operations. It can help you write an {esql} query for a particular use case, or answer general questions about how to use the platform. Its ability to assist you depends on the specificity and detail of your questions. The more context and detail you provide, the more tailored and useful its responses will be.

NOTE: The agent has access to index names and field metadata from your cluster. This contextual information helps improve ES|QL generation, though it may slightly increase response times.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
NOTE: The agent has access to index names and field metadata from your cluster. This contextual information helps improve ES|QL generation, though it may slightly increase response times.
NOTE: AI Assistant has access to index names and field metadata from your cluster. This contextual information helps improve {{esql}} generation, however it may slightly increase response times.

How would the user control whether this metadata is included?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They can't control this currently. I will speak with the team to see what they think about giving the user control over this.


To maximize its usefulness, consider using more detailed prompts or asking for additional information. For instance, after asking for an {esql} query example, you could ask a follow-up question like, “Could you give me some other examples?” You can also ask for clarification or further exposition, for example "Please provide comments explaining the query you just gave."

In addition to practical advice, AI Assistant can offer conceptual advice, tips, and best practices for enhancing your security measures. You can ask it, for example:
Expand Down