[Request] Improvements to Attack Discovery

[dhru42]

Description

Some changes to Attack Discovery in the 8.16 Release

• Output chunking boosts the maximum number of alerts that can be sent as context, addressing the token limitations of LLMs.
• The new default and maximum alert values are not yet finalized, but the expected change is [previous default: 20, previous max: 100; new default: 250, new max: 500].
• A new refinement step now automatically merges related discoveries that were previously shown as separate findings.
• In the past, users had to set the number of alerts sent as context in the assistant settings. Now, a new settings modal allows this to be done directly from the Attack Discovery page.
• Hallucination detection now triggers an error message instead of displaying any hallucinated output.

Background & resources

• PRs:
• Issues/metas:
• Point of contact: @jamesspi @andrew-goldstein
• Test environments:

Which documentation set does this change impact?

ESS and serverless

ESS release

8.16

Serverless release

TBD

Feature differences

N/A

API docs impact

n/a

Prerequisites, privileges, feature flags

No response