[Security Assistant] EIS usage callout #221566

angorayc · 2025-05-26T22:49:18Z

Summary

https://github.com/elastic/security-team/issues/12656
https://github.com/elastic/kibana/pull/220782/files#

To test:

export VAULT_ADDR=https://secrets.elastic.co:8200/
vault login --method=oidc
node scripts/eis.js

Callouts will not appear again once dismissed. Please clear the local storage if you want them to show up again.

onboarding hub:

Assistant:

Conversation:

Integration:

Attack Discovery:

feature_flags.overrides:
  securitySolution.attackDiscoveryAlertsEnabled: true
  securitySolution.assistantAttackDiscoverySchedulingEnabled: true

Connectors:

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Unit or functional tests were updated or added to match the most common scenarios

kibanamachine · 2025-05-29T15:32:41Z

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/212

…/12656

kibanamachine · 2025-05-29T15:37:09Z

Project deployed, see credentials at: https://buildkite.com/elastic/kibana-deploy-project-from-pr/builds/462

semd

Threat hunting code LGTM

Bamieh

core changes LGMT (removal of esUiShared requiredBundle in kibana.jsonc file)

bhapas

LGTM [ Automatic Import changes ]

elasticmachine · 2025-06-16T12:26:36Z

💚 Build Succeeded

Buildkite Build
Commit: 0c221b1
Cloud Deployment
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-221566-0c221b1c515d
Security Deployment

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`automaticImport`	781	753	-28
`securitySolution`	7602	7610	+8
`stackConnectors`	320	321	+1
total			-19

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`aiAssistantManagementSelection`	76.9KB	77.0KB	+145.0B
`automaticImport`	1.1MB	1.1MB	-2.0KB
`lists`	123.6KB	123.7KB	+145.0B
`securitySolution`	9.3MB	9.3MB	+11.3KB
`stackConnectors`	623.2KB	624.5KB	+1.3KB
total			+10.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`automaticImport`	11.6KB	11.2KB	-470.0B
`core`	456.7KB	456.8KB	+145.0B
`securitySolution`	93.2KB	93.2KB	+1.0B
`stackConnectors`	60.5KB	60.8KB	+231.0B
total			-93.0B

Unknown metric groups

async chunk count

id	before	after	diff
`stackConnectors`	101	102	+1

ESLint disabled line counts

id	before	after	diff
`stackConnectors`	133	134	+1

miscellaneous assets size

id	before	after	diff
`automaticImport`	891.4KB	250.8KB	-640.6KB

Total ESLint disabled count

id	before	after	diff
`stackConnectors`	137	138	+1

History

💔 Build #308709 failed 3a5eb5b
💛 Build #308584 was flaky bcebe8c
💚 Build #308387 succeeded 0e47f80
💔 Build #308254 failed 6dd7aa3

kibanamachine · 2025-06-16T13:35:51Z

Starting backport for target branches: 8.18, 8.19, 9.0

https://github.com/elastic/kibana/actions/runs/15682351634

kibanamachine · 2025-06-16T13:42:45Z

💔 All backports failed

Status	Branch	Result
❌	8.18	Backport failed because of merge conflicts
❌	8.19	Backport failed because of merge conflicts
❌	9.0	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 221566

Questions ?

Please refer to the Backport tool documentation

elastic/security-team#12656 https://github.com/elastic/kibana/pull/220782/files# To test: 1. https://p.elstc.co/paste/w06HF7Yw#2tr6JjZXmUbjQ6TQdpgdenH4YOjiWdAoHCZ3OpRi5JG 2. locally: ``` export VAULT_ADDR=https://secrets.elastic.co:8200/ vault login --method=oidc node scripts/eis.js ``` Callouts will not appear again once dismissed. Please clear the local storage if you want them to show up again. <img width="2557" alt="Screenshot 2025-05-29 at 15 53 21" src="https://github.com/user-attachments/assets/506925cb-5bce-4a66-918e-cd9e000c7088" /> onboarding hub: <img width="2559" alt="Screenshot 2025-05-29 at 09 32 14" src="https://github.com/user-attachments/assets/4c8b99e5-156e-4062-95a9-fa45c101b858" /> Assistant: <img width="1282" alt="Screenshot 2025-06-11 at 15 16 09" src="https://github.com/user-attachments/assets/30d47a05-ded1-4c3e-9540-6ad97fda0a8b" /> Conversation: <img width="674" alt="452997822-5c0b3933-b253-474e-92a5-d8793ebff819" src="https://github.com/user-attachments/assets/97506996-9a85-45bb-a728-79df37bd592e" /> Integration: <img width="2559" alt="Screenshot 2025-05-28 at 21 28 11" src="https://github.com/user-attachments/assets/ec564dac-2aed-4ac5-ad2c-67728d6f3eda" /> Attack Discovery: <img width="2560" alt="Screenshot 2025-06-11 at 15 35 08" src="https://github.com/user-attachments/assets/9816fc43-0e6e-40b2-862b-82673330c4da" /> ``` feature_flags.overrides: securitySolution.attackDiscoveryAlertsEnabled: true securitySolution.assistantAttackDiscoverySchedulingEnabled: true ``` <img width="2560" alt="Screenshot 2025-06-11 at 15 30 53" src="https://github.com/user-attachments/assets/7089626f-a416-4260-92f0-1be3f06cf5d3" /> Connectors: <img width="2559" alt="Screenshot 2025-06-10 at 11 15 41" src="https://github.com/user-attachments/assets/74773473-ff1c-41c1-bdd5-fe6e64b9a497" /> Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: florent-leborgne <[email protected]> Co-authored-by: Viduni Wickramarachchi <[email protected]> (cherry picked from commit ed9f4e9)

# Backport This will backport the following commits from `main` to `8.18`: - [Security Assistant] EIS usage callout #221566(#221566) --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: florent-leborgne <[email protected]> Co-authored-by: Viduni Wickramarachchi <[email protected]>

Tracks #221566 Closes elastic/security-team#12824 With this change, whenever a user selects the Elastic LLM connector within the Automatic Troubleshooting feature, they'll see a callout informing them about the potential costs of using it. Once the callout is acknowledged, it will be dismissed and the closed state will be stored in local storage, so it won’t appear again on future visits. To enable EIS locally: ``` export VAULT_ADDR=https://secrets.elastic.co:8200/ vault login --method=oidc node scripts/eis.js ``` and run ES server with provided env + start kibana with .dev.yaml entry from the output of the command above. https://github.com/user-attachments/assets/51a2ce77-ed25-4611-9d62-72e9d09bb789 --------- Co-authored-by: Angela Chuang <[email protected]> Co-authored-by: Angela Chuang <[email protected]> Co-authored-by: kibanamachine <[email protected]> Co-authored-by: florent-leborgne <[email protected]> Co-authored-by: Viduni Wickramarachchi <[email protected]>

# Backport This will backport the following commits from `main` to `8.18`: - [Security Assistant] EIS usage callout #221566(#221566) --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: florent-leborgne <[email protected]> Co-authored-by: Viduni Wickramarachchi <[email protected]>

Tracks elastic#221566 Closes elastic/security-team#12824 With this change, whenever a user selects the Elastic LLM connector within the Automatic Troubleshooting feature, they'll see a callout informing them about the potential costs of using it. Once the callout is acknowledged, it will be dismissed and the closed state will be stored in local storage, so it won’t appear again on future visits. To enable EIS locally: ``` export VAULT_ADDR=https://secrets.elastic.co:8200/ vault login --method=oidc node scripts/eis.js ``` and run ES server with provided env + start kibana with .dev.yaml entry from the output of the command above. https://github.com/user-attachments/assets/51a2ce77-ed25-4611-9d62-72e9d09bb789 --------- Co-authored-by: Angela Chuang <[email protected]> Co-authored-by: Angela Chuang <[email protected]> Co-authored-by: kibanamachine <[email protected]> Co-authored-by: florent-leborgne <[email protected]> Co-authored-by: Viduni Wickramarachchi <[email protected]> (cherry picked from commit dfe6f54)

add EIS cost callout

b080d0e

angorayc added ci:cloud-deploy Create or update a Cloud deployment ci:project-deploy-security Create a Security Serverless Project labels May 26, 2025

angorayc changed the title ~~add EIS cost callout~~ EIS usage callout May 27, 2025

angorayc added 3 commits May 27, 2025 16:46

show EIS callout when it's selected

28f48ce

conversation EIS message

3506eb5

use Elastic Managed LLM connector

f1cc5b5

angorayc added v9.1.0 v8.19.0 Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels labels May 28, 2025

angorayc added 2 commits May 28, 2025 21:38

fix message

870f2ce

wording

3bc8d0a

angorayc marked this pull request as ready for review May 29, 2025 14:57

angorayc requested review from a team as code owners May 29, 2025 14:57

angorayc added the release_note:enhancement label May 29, 2025

Merge branch 'main' into issues/12656

8ca4174

angorayc changed the title ~~EIS usage callout~~ [GenAI] EIS usage callout May 29, 2025

angorayc changed the title ~~[GenAI] EIS usage callout~~ [Security GenAI] EIS usage callout May 29, 2025

angorayc added 2 commits May 29, 2025 16:34

add usage cost url

f1686d7

Merge branch 'issues/12656' of github.com:angorayc/kibana into issues…

bf24095

…/12656

angorayc added 2 commits May 30, 2025 10:09

i18n fix

d07f6d5

unit tests

3857c09

angorayc requested a review from a team as a code owner May 30, 2025 15:45

angorayc added 2 commits June 13, 2025 11:05

hide AnonymizedValuesAndCitationsTour when eis tour is active

52aabb7

update links

6dd7aa3

angorayc requested a review from darnautov June 13, 2025 10:48

tests

0e47f80

semd approved these changes Jun 13, 2025

View reviewed changes

Merge branch 'main' into issues/12656

bcebe8c

Bamieh approved these changes Jun 16, 2025

View reviewed changes

szwarckonrad mentioned this pull request Jun 16, 2025

[EDR Workflows]Automatic troubleshooting usage callout #224030

Merged

bhapas approved these changes Jun 16, 2025

View reviewed changes

Merge branch 'main' into issues/12656

3a5eb5b

angorayc enabled auto-merge (squash) June 16, 2025 09:22

Merge branch 'main' into issues/12656

0c221b1

angorayc requested a review from a team June 16, 2025 11:38

angorayc merged commit ed9f4e9 into elastic:main Jun 16, 2025
10 checks passed

angorayc mentioned this pull request Jun 16, 2025

[8.18][Security Assistant] EIS usage callout (#221566) #224107

Merged

kibanamachine mentioned this pull request Jun 16, 2025

[Automatic Migration] Adds ability to change settings when re-processing Rule Migration #222542

Merged

8 tasks

This was referenced Jun 16, 2025

[8.19][Security Assistant] EIS usage callout (#221566) #224117

Merged

[9.0][Security Assistant] EIS usage callout (#221566) #224127

Merged

angorayc mentioned this pull request Jun 23, 2025

[SecurityAssistant] Make assistantProviderProps extends CoreStart #224874

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Security Assistant] EIS usage callout #221566

[Security Assistant] EIS usage callout #221566

Uh oh!

angorayc commented May 26, 2025 •

edited by kibanamachine

Loading

Uh oh!

kibanamachine commented May 29, 2025

Uh oh!

kibanamachine commented May 29, 2025

Uh oh!

semd left a comment

Uh oh!

Bamieh left a comment

Uh oh!

bhapas left a comment

Uh oh!

elasticmachine commented Jun 16, 2025 •

edited

Loading

async chunk count

ESLint disabled line counts

miscellaneous assets size

Total ESLint disabled count

Uh oh!

Uh oh!

kibanamachine commented Jun 16, 2025

Uh oh!

kibanamachine commented Jun 16, 2025

Uh oh!

Uh oh!

[Security Assistant] EIS usage callout #221566

[Security Assistant] EIS usage callout #221566

Uh oh!

Conversation

angorayc commented May 26, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

kibanamachine commented May 29, 2025

Uh oh!

kibanamachine commented May 29, 2025

Uh oh!

semd left a comment

Choose a reason for hiding this comment

Uh oh!

Bamieh left a comment

Choose a reason for hiding this comment

Uh oh!

bhapas left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

async chunk count

ESLint disabled line counts

miscellaneous assets size

Total ESLint disabled count

History

Uh oh!

Uh oh!

kibanamachine commented Jun 16, 2025

Uh oh!

kibanamachine commented Jun 16, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

Uh oh!

angorayc commented May 26, 2025 •

edited by kibanamachine

Loading

elasticmachine commented Jun 16, 2025 •

edited

Loading