-
Notifications
You must be signed in to change notification settings - Fork 191
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Serverless] Twin PR, AI use cases (#5471)
* Implements changes from ESS PR * fixes broken id-based links * updates docnav * minor bugfix * bugfixes * minor fixes * incorporates Nat's review
- Loading branch information
1 parent
f9d7847
commit e3b8fbb
Showing
9 changed files
with
139 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
--- | ||
slug: /serverless/security/ai-assistant-esql-queries | ||
title: Generate, customize, and learn about ((esql)) queries | ||
description: AI Assistant has specialized ((esql)) capabilities. | ||
tags: ["security","overview","get-started"] | ||
status: in review | ||
--- | ||
|
||
Elastic AI Assistant can help you learn about and leverage the Elasticsearch Query Language (((esql))). | ||
|
||
With AI Assistant's <DocLink slug="/serverless/security/ai-assistant" section="ai-assistant-knowledge-base" text="ES|QL knowledge base"/> enabled, AI Assistant benefits from specialized training data that enables it to answer questions related to ((esql)) at an expert level. | ||
|
||
AI Assistant can help with ((esql)) in many ways, including: | ||
|
||
* **Education and training**: AI Assistant can serve as a powerful ((esql)) learning tool. Ask it for examples, explanations of complex queries, and best practices. | ||
* **Writing new queries**: Prompt AI Assistant to provide a query that accomplishes a particular task, and it will generate a query matching your description. For example: "Write a query to identify documents with `curl.exe` usage and calculate the sum of `destination.bytes`" or "What query would return all user logins to [a host] in the last six hours?" | ||
* **Providing feedback to optimize existing queries**: Send AI Assistant a query you want to work on and ask it for improvements, refactoring, a general assessment, or to optimize the query's performance with large data sets. | ||
* **Customizing queries for your environment**: Since each environment is unique, you may need to customize queries that you used in other contexts. AI Assistant can suggest necessary modifications based on contextual information you provide. | ||
* **Troubleshooting**: Having trouble with a query or getting unexpected results? Ask AI Assistant to help you troubleshoot. | ||
|
||
In these ways and others, AI Assistant can enable you to make use of ((esql))'s advanced search capabilities to accomplish goals across ((elastic-sec)). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
--- | ||
slug: /serverless/security/ai-use-cases | ||
title: Use cases | ||
description: Learn about use cases for AI in ((elastic-sec)). | ||
tags: ["security","overview","get-started"] | ||
status: in review | ||
--- | ||
|
||
The guides in this section describe use cases for AI Assistant and Attack discovery. Refer to them for examples of each tool's individual capabilities, and of what they can do together. | ||
|
||
* <DocLink slug="/serverless/security/ai-usecase-incident-reporting"/> | ||
* <DocLink slug="/serverless/security/triage-alerts-with-elastic-ai-assistant"/> | ||
* <DocLink slug="/serverless/security/ai-assistant-esql-queries"/> |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added
BIN
+497 KB
docs/serverless/assistant/images/attck-disc-esql-query-gen-example.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
--- | ||
slug: /serverless/security/llm-connector-guides | ||
title: LLM connector guides | ||
description: Set up LLM connectors to enable AI features in ((elastic-sec)) | ||
tags: ["security","overview","get-started"] | ||
status: in review | ||
--- | ||
|
||
This section contains instructions for setting up connectors for LLMs so you can use <DocLink slug="/serverless/security/ai-assistant" text="Elastic AI Assistant"/> and <DocLink slug="/serverless/security/attack-discovery" text="Attack discovery"/>. | ||
|
||
Setup guides are available for the following LLM providers: | ||
|
||
* <DocLink slug="/serverless/security/connect-to-azure-openai" text="Azure OpenAI"/> | ||
* <DocLink slug="/serverless/security/connect-to-bedrock" text="Amazon Bedrock"/> | ||
* <DocLink slug="/serverless/security/connect-to-openai" text="OpenAI"/> |
57 changes: 57 additions & 0 deletions
57
docs/serverless/assistant/usecase-attack-disc-ai-assistant-incident-reporting.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,57 @@ | ||
--- | ||
slug: /serverless/security/ai-usecase-incident-reporting | ||
title: Identify, investigate, and document threats | ||
description: Use Attack discovery and AI Assistant to manage threats. | ||
tags: ["security","overview","get-started"] | ||
status: in review | ||
--- | ||
|
||
Together, <DocLink slug="/serverless/security/ai-assistant" text="Elastic AI Assistant"/> and <DocLink slug="/serverless/security/attack-discovery" text="Attack discovery"/> can help you identify and mitigate threats, investigate incidents, and generate incident reports in various languages so you can monitor and protect your environment. | ||
|
||
In this guide, you'll learn how to: | ||
|
||
* <DocLink slug="/serverless/security/ai-usecase-incident-reporting" section="use-case-incident-reporting-use-attack-discovery-to-identify-threats" text="Use Attack discovery to identify threats"/> | ||
* <DocLink slug="/serverless/security/ai-usecase-incident-reporting" section="use-case-incident-reporting-use-ai-assistant-to-analyze-a-threat" text="Use AI Assistant to analyze a threat"/> | ||
* <DocLink slug="/serverless/security/ai-usecase-incident-reporting" section="use-case-incident-reporting-create-a-case-using-ai-assistant" text="Create a case using AI Assistant"/> | ||
* <DocLink slug="/serverless/security/ai-usecase-incident-reporting" section="use-case-incident-reporting-translate" text="Translate incident information to a different human language using AI Assistant"/> | ||
|
||
|
||
<div id="use-case-incident-reporting-use-attack-discovery-to-identify-threats"/> | ||
## Use Attack discovery to identify threats | ||
Attack discovery can detect a wide range of threats by finding relationships among alerts that may indicate a coordinated attack. This enables you to comprehend how threats move through and affect your systems. Attack discovery generates a detailed summary of each potential threat, which can serve as the basis for further analysis. Learn how to <DocLink slug="/serverless/security/attack-discovery" text="get started with Attack discovery"/>. | ||
|
||
<DocImage url="images/attck-disc-11-alerts-disc.png" alt="An Attack discovery card showing an attack with 11 related alerts"/> | ||
|
||
In the example above, Attack discovery found connections between eleven alerts, and used them to identify and describe an attack chain. | ||
|
||
After Attack discovery outlines your threat landscape, use Elastic AI Assistant to quickly analyze a threat in detail. | ||
|
||
<div id="use-case-incident-reporting-use-ai-assistant-to-analyze-a-threat"/> | ||
## Use AI Assistant to analyze a threat | ||
|
||
From a discovery on the Attack discovery page, click **View in AI Assistant** to start a chat that includes the discovery as context. | ||
|
||
AI Assistant can quickly compile essential data and provide suggestions to help you generate an incident report and plan an effective response. You can ask it to provide relevant data or answer questions, such as “How can I remediate this threat?” or “What ((esql)) query would isolate actions taken by this user?” | ||
|
||
<DocImage url="images/attck-disc-esql-query-gen-example.png" alt="An AI Assistant dialogue in which the user asks for a purpose-built ES|QL query" /> | ||
|
||
The image above shows an ((esql)) query generated by AI Assistant in response to a user prompt. Learn more about <DocLink slug="/serverless/security/ai-assistant-esql-queries" text="using AI Assistant for ES|QL"/>. | ||
|
||
At any point in a conversation with AI Assistant, you can add data, narrative summaries, and other information from its responses to ((elastic-sec))'s case management system to generate incident reports. | ||
|
||
<div id="use-case-incident-reporting-create-a-case-using-ai-assistant"/> | ||
## Create a case using AI Assistant | ||
|
||
From the AI Assistant dialog window, click **Add to case** (<DocIcon type="addDataApp" title="Add data" />) next to a message to add the information in that message to a <DocLink slug="/serverless/security/cases-overview" text="case"/>. Cases help centralize relevant details in one place for easy sharing with stakeholders. | ||
|
||
If you add a message that contains a discovery to a case, AI Assistant automatically adds the attack summary and all associated alerts to the case. You can also add AI Assistant messages that contain remediation steps and relevant data to the case. | ||
|
||
<div id="use-case-incident-reporting-translate"/> | ||
## Translate incident information to a different human language using AI Assistant | ||
AI Assistant can translate its findings into other human languages, helping to enable collaboration among global security teams, and making it easier to operate within multilingual organizations. | ||
|
||
After AI Assistant provides information in one language, you can ask it to translate its responses. For example, if it provides remediation steps for an incident, you can instruct it to “Translate these remediation steps into Japanese.” You can then add the translated output to a case. This can help team members receive the same information and insights regardless of their primary language. | ||
|
||
<DocCallOut title="Note"> | ||
In our internal testing, AI Assistant translations preserved the accuracy of the original content. However, all LLMs can make mistakes, so use caution. | ||
</DocCallOut> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters