Adds new page about triaging alerts with AI Assistant

docs/assistant/ai-alert-triage.asciidoc

@@ -0,0 +1,28 @@
+[[assistant-triage]]
+= Triage Alerts with Elastic AI Assistant
+Elastic AI Assistant can help you enhance and streamline your alert triage workflows. 
+
+AI Assistant can help you interpret an alert and understand its context. When you view an alert in {elastic-sec}, details such as related documents, host, and users appear alongside a synopsis of the events that triggered the alert. This data provides a starting point for understanding a potential threat. AI Assistant can answer questions about this data and offer insights and actionable recommendations to remediate the issue.
+
+[discrete]
+== Use AI Assistant to triage an alert
+. First, choose an alert to investigate. Click **View details**.
+. On the details flyout, click **Chat** to launch the AI assistant.
+. Data related to the selected alert is automatically added to the prompt. Click **Alert (from summary)** to view which alert fields will be shared with AI Assistant. (For more information about selecting which fields to send, and to learn about anonymizing your data, refer to <<security-assistant, AI Assistant>>.)
+. You can click a quick prompt to use it as a starting point for your query, for example **Alert summarization**. You can improve the quality of AI Assistant's response by customizing the prompt and adding detail. 
+. Once you’ve submitted your query, the AI Assistant will process the information and provide a detailed response. Depending on your prompt and which alert data you included, its response can include a thorough analysis of the alert that highlights key elements such as the nature of the potential threat, potential impact, and suggested response actions.
+. Remember, the response is not a static report; you can ask follow-up questions, provide additional information for further analysis, and request clarification.
+
+[discrete]
+[[ai-triage-reportgen]]
+== Report Generation
+Elastic AI Assistant can streamline the process of documentation and report generation, helping you provide stakeholders clear records of security incidents, including their scope and impact, and your remediation efforts. You can use AI Assistant to create summaries or reports that include key event details, findings, and diagrams. Once the AI Assistant has finished analyzing one or more alerts, you can generate reports by using prompts such as:
+
+* “Generate a detailed report about this incident including timeline, impact analysis, and response actions. Also, include a diagram of events.”
+* “Generate a summary of this incident/alert and include diagrams of events.”
+* “Provide more details on the mitigation strategies used.”
+
+After reviewing the report, you can add it to a case to keep a record and make it available to your team by clicking **Add to existing case** at the top of AI Assistant's response:
+
+[role="screenshot"]
+image::images/ai-triage-add-to-case.png[An AI Assistant dialogue with the add to existing case button highlighted]

docs/assistant/security-assistant.asciidoc

@@ -191,3 +191,6 @@ In addition to practical advice, AI Assistant can offer conceptual advice, tips,
 
 * “How do I set up a {ml} job in {elastic-sec} to detect anomalies in network traffic volume over time?”
 * “I need to monitor for unusual file creation patterns that could indicate ransomware activity. How would I construct this query using EQL?”
+
+
+include::ai-alert-triage.asciidoc[leveloffset=+1]