Elastic Ai

Elastic AI is an advanced AI platform that enhances user interactions through sophisticated conversational capabilities.

Elastic AI provides advanced security analysis and automation capabilities through its integration with Swimlane Turbine. This connector allows users to interact with Elastic AI's large language model for comprehensive security insights and recommendations. By leveraging Elastic AI, Swimlane Turbine end-users can automate the analysis of security events, streamline incident response, and enhance threat detection with real-time insights and contextual data. The integration empowers security teams to efficiently manage conversations, retrieve and update security insights, and automate responses, thereby improving overall security posture and operational efficiency.

The Elastic AI connector allows for streamlined integration with Elastic AI's conversational intelligence services, enabling automated conversation management and analysis.

Elastic AI is a powerful language model platform that enables advanced communication and analysis capabilities. This connector allows Swimlane Turbine users to integrate with Elastic AI's conversational APIs, facilitating real-time interactions with large language models (LLMs). Users can create, update, and manage AI-driven conversations, leveraging Elastic AI's capabilities to analyze security events, generate insights, and automate responses within the Swimlane ecosystem. The integration enhances security operations by providing actionable intelligence and streamlining incident analysis and triage through natural language processing.

Prerequisites

Before you can use the Elastic AI connector for Turbine, you'll need access to the Elastic AI API. This requires the following:

API key authentication using the following parameters:

URL: The endpoint for accessing Elastic AI services.

API Key: A unique key provided by Elastic AI for secure access.

HTTP Basic authentication using the following parameters:

URL: The endpoint for accessing Elastic AI services.

Username: Your Elastic AI account username.

Password: Your Elastic AI account password.

Capabilities

This Connector provides the following capabilities:

Complete Chat

Create Conversation

Delete Conversation

Find Conversations

Get Conversation

Update Conversations

Notes

Elastic AI API Documentation

Additional Documentation

Elastic Ai Connector Documentation

Elastic Ai API Documentation

Configurations

Elastic AI API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
port	Host port to use.	number	Optional
x-apikey	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Elastic AI HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Complete Chat

Communicate with Elastic AI's large language model, optionally persisting the conversation by creating or extending a session. Requires connectorId, persist, and messages in JSON body.

Endpoint

URL: /api/security_ai_assistant/chat/complete

Method: POST

Input

Argument Name	Type	Required	Description
conversationId	string	Optional	Conversation ID to append to messages and use as context. Refer to conversation APIs.
connectorId	string	Optional	ID for an LLM connector a Kibana integration with the specific LLM provider.
promptId	string	Optional	Default conversation prompt ID.
persist	boolean	Optional	Defines if the conversation should be created, or updated (if conversationId is provided).
isStream	boolean	Optional	Define the type of the response. If isStream equals true, the result will be returned as streaming chunks.
model	string	Optional	Name of a specific LLM to use.
responseLanguage	string	Optional	Defines the language for the LLM to respond in.
messages	array	Optional	Array of conversation messages.
messages.role	string	Required	Message role. Can be "user", "assistant" or "system".
messages.content	string	Required	Message content to send to LLM.
messages.data	object	Optional	JSON object to include as context for the model.
messages.data.event.category	string	Optional	Response data
messages.data.process.pid	number	Optional	Response data
messages.data.host.os.version	number	Optional	Response data
messages.data.host.os.name	string	Optional	Response data
messages.data.host.name	string	Optional	Response data
messages.data.process.name	string	Optional	Response data
messages.data.user.name	string	Optional	Response data
messages.data.process.working_directory	string	Optional	Response data
messages.data.event.module	string	Optional	Response data
messages.data.process.executable	string	Optional	Response data
messages.data.process.args	string	Optional	Response data
messages.data.message	string	Optional	Response data
messages.fields_to_anonymize	array	Optional	List of fields in the data object to anonymize.

Input Example

{"json_body":{"conversationId":"df071e68-3c8e-4c0d-b0e7-1557e80c0319","connectorId":"my-gpt4o-ai","promptId":"","persist":false,"isStream":false,"model":"","responseLanguage":"","messages":[{"role":"user","content":"Evaluate the event from the context and format your output neatly in markdown syntax for my Elastic Security case.\nAdd your description, recommended actions and bulleted triage steps. Use the MITRE ATT&CK data provided to add more context and recommendations from MITRE, and hyperlink to the relevant pages on MITRE's website. Be sure to include the user and host risk score data from the context. Your response should include steps that point to Elastic Security specific features, including endpoint response actions, the Elastic Agent OSQuery manager integration (with example osquery queries), timelines and entity analytics and link to all the relevant Elastic Security documentation.","data":{"event.category":"process","process.pid":69516,"host.os.version":14.5,"host.os.name":"macOS","host.name":"test-MBP","process.name":"biomesyncd","user.name":"usertest","process.working_directory":"/","event.module":"system","process.executable":"/usr/libexec/biomesyncd","process.args":"/usr/libexec/biomesyncd","message":"Process biomesyncd (PID: 69516) by user usertest STOPPED"},"fields_to_anonymize":["host.os.name","event.module"]}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
connector_id	string	Unique identifier
data	string	Response data
trace_data	object	Response data
trace_data.transactionId	string	Response data
trace_data.traceId	string	Response data
replacements	object	Output field: replacements
replacements.dc00f5d9-bdf3-4517-b7ef-de5a89f0d071	string	Output field: replacements.dc00f5d9-bdf3-4517-b7ef-de5a89f0d071
replacements.e4d4dc93-754e-4282-ac84-94fe72071ab1	string	Output field: replacements.e4d4dc93-754e-4282-ac84-94fe72071ab1
replacements.2fede99b-5ec7-4274-b990-469b4110f7ba	string	Output field: replacements.2fede99b-5ec7-4274-b990-469b4110f7ba
replacements.661a7e8f-42c3-4f8c-a1bc-6ff1aa750034	string	Output field: replacements.661a7e8f-42c3-4f8c-a1bc-6ff1aa750034
status	string	Status value
conversationId	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"663","Content-Security-Policy":"script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; styl...","Content-Security-Policy-Report-Only":"form-action 'report-sample' 'self'; report-to violations-endpoint","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Sep 2024 08:01:15 GMT","Elastic-Api-Version":"202...

Create Conversation

Initiate a new conversation with the Elastic AI Assistant using a specified title.

Endpoint

URL: /api/security_ai_assistant/current_user/conversations

Method: POST

Input

Argument Name	Type	Required	Description
title	string	Optional	Conversation title. If you set it to "New chat", the AI will generate a title.
category	string	Optional	Can be "assistant", "insights", or not defined.
messages	array	Optional	Array of conversation messages.
messages.content	string	Optional	Message content to send to LLM.
messages.role	string	Required	Message role. Can be "user", "assistant", or "system".
messages.isError	boolean	Optional	Define if the message is an error message instead of an LLM response.
messages.timestamp	string	Optional	Timestamp when the message was sent.
messages.traceData	object	Optional	Response data
messages.traceData.traceId	string	Optional	Response data
messages.traceData.transactionId	string	Optional	Response data
apiConfig	object	Optional	Conversation configuration.
apiConfig.actionTypeId	string	Required	Kibana connector action type ID.
apiConfig.connectorId	string	Required	Kibana connector ID.
apiConfig.defaultSystemPromptId	string	Required	Default system prompt ID.
apiConfig.model	string	Optional	Specific LLM name.
isDefault	boolean	Optional	Define if conversation is a system conversation which cannot be deleted. Defaults to false.
excludeFromLastConversationStorage	boolean	Optional	Defines if conversation can appear as the latest conversation.
replacements	object	Optional	Parameter for Create Conversation
replacements.field1	string	Optional	List of the fields with anonymization.

Input Example

{"json_body":{"title":"The conversation title.","category":"assistant","messages":[{"content":"test content","role":"user","isError":false,"timestamp":"2019-12-13T16:40:33.400Z","traceData":{"traceId":"1234","transactionId":"2"}}],"apiConfig":{"actionTypeId":".gen-ai","connectorId":"86ab-471c-a00b-25b7e20c2d12","defaultSystemPromptId":"Default","model":"gpt-4o"},"isDefault":false,"excludeFromLastConversationStorage":true,"replacements":{"field1":"914beb92-86ab-471c-a00b"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
title	string	Output field: title
category	string	Output field: category
timestamp	string	Output field: timestamp
updatedAt	string	Output field: updatedAt
createdAt	string	Output field: createdAt
replacements	object	Output field: replacements
replacements.field1	string	Output field: replacements.field1
users	array	Output field: users
users.name	string	Name of the resource
messages	array	Response message
messages.content	string	Response content
messages.role	string	Response message
messages.timestamp	string	Response message
messages.traceData	object	Response data
messages.traceData.transactionId	string	Response data
messages.traceData.traceId	string	Response data
apiConfig	object	Output field: apiConfig
apiConfig.connectorId	string	Unique identifier
apiConfig.actionTypeId	string	Unique identifier
apiConfig.defaultSystemPromptId	string	Unique identifier
apiConfig.model	string	Output field: apiConfig.model
isDefault	boolean	Output field: isDefault

Output Example

Delete Conversation

Remove a specific Elastic AI Assistant conversation using the provided conversation ID.

Endpoint

URL: /api/security_ai_assistant/current_user/conversations/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The conversation ID.

Input Example

{"path_parameters":{"id":"df071e68-3c8e-4c0d-b0e7-1557e80c0319"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"2","Content-Security-Policy":"script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; styl...","Content-Security-Policy-Report-Only":"form-action 'report-sample' 'self'; report-to violations-endpoint","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Sep 2024 09:42:17 GMT","Elastic-Api-Version":"2023-...

Find Conversations

Retrieve a list of conversations from Elastic AI Assistant specific to the current user.

Endpoint

URL: /api/security_ai_assistant/current_user/conversations/_find

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	The page number to return. Defaults to 1.
parameters.per_page	number	Optional	The number of items to return per page. Defaults to 10.
parameters.filter	string	Optional	The filter query to apply on the request.
parameters.sort_field	string	Optional	The field to sort the results by.
parameters.sort_order	string	Optional	The order to sort the results in.
parameters.fields	string	Optional	Defines the fields of the document to return in the response.

Input Example

{"parameters":{"page":1,"per_page":10,"filter":"","sort_field":"title","sort_order":"asc","fields":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
perPage	number	Output field: perPage
page	number	Output field: page
total	number	Output field: total
data	array	Response data
data.timestamp	string	Response data
data.createdAt	string	Response data
data.users	array	Response data
data.users.id	string	Response data
data.users.name	string	Response data
data.title	string	Response data
data.category	string	Response data
data.apiConfig	object	Response data
data.apiConfig.connectorId	string	Response data
data.apiConfig.actionTypeId	string	Response data
data.apiConfig.defaultSystemPromptId	string	Response data
data.apiConfig.model	string	Response data
data.excludeFromLastConversationStorage	boolean	Response data
data.isDefault	boolean	Response data
data.messages	array	Response data
data.messages.timestamp	string	Response data
data.messages.content	string	Response data
data.messages.role	string	Response data
data.messages.traceData	object	Response data

Output Example

{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"706","Content-Security-Policy":"script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; styl...","Content-Security-Policy-Report-Only":"form-action 'report-sample' 'self'; report-to violations-endpoint","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 06 Sep 2024 09:53:24 GMT","E...

Get Conversation

Retrieve an existing conversation from Elastic AI Assistant using the specified conversation ID.

Endpoint

URL: /api/security_ai_assistant/current_user/conversations/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Conversation ID.

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timestamp	string	Output field: timestamp
createdAt	string	Output field: createdAt
users	array	Output field: users
users.name	string	Name of the resource
title	string	Output field: title
category	string	Output field: category
apiConfig	object	Output field: apiConfig
apiConfig.connectorId	string	Unique identifier
apiConfig.actionTypeId	string	Unique identifier
apiConfig.defaultSystemPromptId	string	Unique identifier
apiConfig.model	string	Output field: apiConfig.model
excludeFromLastConversationStorage	boolean	Output field: excludeFromLastConversationStorage
isDefault	boolean	Output field: isDefault
messages	array	Response message
messages.timestamp	string	Response message
messages.content	string	Response content
messages.role	string	Response message
messages.traceData	object	Response data
messages.traceData.traceId	string	Response data
messages.traceData.transactionId	string	Response data
updatedAt	string	Output field: updatedAt
replacements	object	Output field: replacements
replacements.field1	string	Output field: replacements.field1

Output Example

{"status_code":200,"response_headers":{"Accept-Ranges":"bytes","Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"663","Content-Security-Policy":"script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; styl...","Content-Security-Policy-Report-Only":"form-action 'report-sample' 'self'; report-to violations-endpoint","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Tue, 10 Sep 2024 09:01:21 GMT","E...

Update Conversations

Update an existing conversation in Elastic AI Assistant using the specified conversation ID and provided data.

Endpoint

URL: /api/security_ai_assistant/current_user/conversations/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The conversation ID.
id	string	Optional	Conversation ID to update.
title	string	Optional	Conversation title. If you set it to "New chat", the AI will generate a title.
messages	array	Optional	Array of conversation messages.
messages.content	string	Required	Message content to send to LLM.
messages.role	string	Required	Message role. Can be "user", "assistant", or "system".
messages.isError	boolean	Optional	Define if the message is an error message instead of an LLM response.
messages.timestamp	string	Optional	Timestamp when the message was sent.
apiConfig	object	Optional	Conversation configuration.
apiConfig.actionTypeId	string	Optional	Kibana connector action type ID.
apiConfig.connectorId	string	Optional	Kibana connector ID.
apiConfig.defaultSystemPromptId	string	Optional	Default system prompt ID.
apiConfig.model	string	Optional	LLM specific model.

Input Example

{"json_body":{"id":"a696901d-efff-4871-acbe-8123af841932","title":"The conversation title.","messages":[{"content":"test content","role":"user","isError":false,"timestamp":"2019-12-13T16:40:33.400Z"}],"apiConfig":{"actionTypeId":".gen-ai","connectorId":"86ab-471c-a00b-25b7e20c2d12","defaultSystemPromptId":"Default","model":"gpt-4o"}},"path_parameters":{"id":"df071e68-3c8e-4c0d-b0e7-1557e80c0319"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timestamp	string	Output field: timestamp
createdAt	string	Output field: createdAt
users	array	Output field: users
users.id	string	Unique identifier
users.name	string	Name of the resource
title	string	Output field: title
category	string	Output field: category
apiConfig	object	Output field: apiConfig
apiConfig.connectorId	string	Unique identifier
apiConfig.actionTypeId	string	Unique identifier
apiConfig.defaultSystemPromptId	string	Unique identifier
apiConfig.model	string	Output field: apiConfig.model
excludeFromLastConversationStorage	boolean	Output field: excludeFromLastConversationStorage
isDefault	boolean	Output field: isDefault
messages	array	Response message
messages.timestamp	string	Response message
messages.content	string	Response content
messages.role	string	Response message
messages.traceData	object	Response data
messages.traceData.traceId	string	Response data
messages.traceData.transactionId	string	Response data
updatedAt	string	Output field: updatedAt
replacements	object	Output field: replacements

Output Example

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"663","Content-Security-Policy":"script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; styl...","Content-Security-Policy-Report-Only":"form-action 'report-sample' 'self'; report-to violations-endpoint","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Tue, 10 Sep 2024 09:32:10 GMT","Elastic-Api-Version":"202...

Response Headers

Header	Description	Example
Accept-Ranges	HTTP response header: Accept-Ranges	bytes
Cache-Control	Directives for caching mechanisms	private, no-cache, no-store, must-revalidate
Content-Length	The length of the response body in bytes	663
Content-Security-Policy	HTTP response header: Content-Security-Policy	script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'; report-to violations-endpoint
Content-Security-Policy-Report-Only	HTTP response header: Content-Security-Policy-Report-Only	form-action 'report-sample' 'self'; report-to violations-endpoint
Content-Type	The media type of the resource	application/json; charset=utf-8
Cross-Origin-Opener-Policy	HTTP response header: Cross-Origin-Opener-Policy	same-origin
Date	The date and time at which the message was originated	Tue, 10 Sep 2024 09:32:10 GMT
Elastic-Api-Version	HTTP response header: Elastic-Api-Version	2023-10-31
Kbn-License-Sig	HTTP response header: Kbn-License-Sig	7185e757d262d256abd6cd3c45c959fda83e1b945e8acbca3d55d123d792c665
Kbn-Name	HTTP response header: Kbn-Name	instance-0000000001
Permissions-Policy	HTTP response header: Permissions-Policy	camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()
Referrer-Policy	HTTP response header: Referrer-Policy	strict-origin-when-cross-origin
Reporting-Endpoints	HTTP response header: Reporting-Endpoints	violations-endpoint="https://b04803c24d7b4d889da4894db78f841c.us-central1.gcp.cloud.es.io:9243/internal/security/analytics/_record_violations"
X-Cloud-Request-Id	HTTP response header: X-Cloud-Request-Id	w3MpkQQ2TVWZOEo6V53-HA
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Found-Handling-Cluster	HTTP response header: X-Found-Handling-Cluster	b04803c24d7b4d889da4894db78f841c
X-Found-Handling-Instance	HTTP response header: X-Found-Handling-Instance	instance-0000000001