Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expand AI Assistant query advice #4294

Merged
merged 10 commits into from
Nov 30, 2023
Binary file added docs/assistant/images/knowledge-base-dialogue.png
benironside marked this conversation as resolved.
Show resolved Hide resolved
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
15 changes: 14 additions & 1 deletion docs/assistant/security-assistant.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -177,4 +177,17 @@ To enable the knowledge base:
. Turn on the *Knowledge Base* option.
. Click *Save*. The knowledge base is now active.
+
When the knowledge base is active, a quick prompt for {esql} queries becomes available. It provides a good starting point for your {esql} conversations and questions.
When the knowledge base is active, a quick prompt for {esql} queries becomes available. It provides a good starting point for your {esql} conversations and questions.

[discrete]
[[ai-assistant-queries]]
### How to get the most from your queries
benironside marked this conversation as resolved.
Show resolved Hide resolved

The goal of the AI Assistant is to help users take full advantage of the Elastic Security platform to improve their cyber operations. Its ability to assist you depends on the specificity and detail of your questions. The more context and detail you provide, the more tailored and useful its responses will be.
benironside marked this conversation as resolved.
Show resolved Hide resolved
benironside marked this conversation as resolved.
Show resolved Hide resolved

To maximize its usefulness, consider using more detailed or elaborate prompts. For instance, after asking for an {esql} query example, you could ask a follow-up question like, “Could you give me some other examples and provide comments explaining the query you just gave?”. You can also ask for clarification or further exposition.
benironside marked this conversation as resolved.
Show resolved Hide resolved

In addition to practical advice, AI Assistant can offer conceptual advice, tips, and best practices for enhancing your security measures. You can ask it, for example:

. “How do I set up a machine learning job in Elastic Security to detect anomalies in network traffic volume over time?”
benironside marked this conversation as resolved.
Show resolved Hide resolved
. “I need to monitor for unusual file creation patterns that could indicate ransomware activity. How would I construct this query using EQL?”
benironside marked this conversation as resolved.
Show resolved Hide resolved