Skip to content

Commit 4d87617

Browse files
authored
[Security AI Prompts] Add new Entity Highlights prompts (#15750)
1 parent ac7480a commit 4d87617

File tree

79 files changed

+93
-77
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+93
-77
lines changed

packages/security_ai_prompts/changelog.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.0.9"
3+
changes:
4+
- description: "Add new Entity Highlights prompts"
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15750
27
- version: "1.0.8"
38
changes:
49
- description: "Update ease prompts"
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "The suggested remediation action to take for the policy response failure"
77
}
88
},
9-
"id": "security_ai_prompts-6a9fe9d7-5cd3-4d24-b458-f948da93c19f",
9+
"id": "security_ai_prompts-00dba7a7-4edb-4c46-8f6d-aa4670020cd4",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "The process.executable value of the event"
77
}
88
},
9-
"id": "security_ai_prompts-f940864a-3dfe-4c37-b3ff-eb93aca35692",
9+
"id": "security_ai_prompts-02d435d2-3ab1-45f7-be74-0715a8ca2ad9",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "Return **only a single-line stringified JSON object** without any code fences, explanations, or variable assignments. Do **not** wrap the output in triple backticks or any Markdown code block. \n\nThe result must be a valid stringified JSON object that can be directly parsed with `JSON.parse()` in JavaScript.\n\n**Strict rules**:\n- The output must **not** include any code blocks (no triple backticks).\n- The output must be **a string**, ready to be passed directly into `JSON.parse()`.\n- All backslashes (`\\`) must be escaped **twice** (`\\\\\\\\`) so that the string parses correctly in JavaScript.\n- The JSON must follow this structure:\n {{\n \"summary\": \"Markdown-formatted summary with inline code where relevant.\",\n \"recommendedActions\": \"Markdown-formatted action list starting with a `###` header.\"\n }}\n- The summary text should just be text. It does not need any titles or leading items in bold.\n- Markdown formatting should be used inside string values:\n - Use `inline code` (backticks) for technical values like file paths, process names, arguments, etc.\n - Use `**bold**` for emphasis.\n - Use `-` for bullet points.\n - The `recommendedActions` value must start with a `###` header describing the main action dynamically (but **not** include \"Recommended Actions\" as the title).\n- **Do not** include any extra explanation or text. Only return the stringified JSON object.\n\nThe response should look like this:\n{{\"summary\":\"Markdown-formatted summary text.\",\"recommendedActions\":\"Markdown-formatted action list starting with a ### header.\"}}"
77
}
88
},
9-
"id": "security_ai_prompts-924663fd-7d79-46b6-8eb9-77db4e242c96",
9+
"id": "security_ai_prompts-0760d6bb-3255-4db8-8512-38ba25055a74",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "Discover the types of questions you can ask"
77
}
88
},
9-
"id": "security_ai_prompts-be609c1f-1385-44c9-856e-40d23d3635e3",
9+
"id": "security_ai_prompts-07abbb80-404c-4d31-b4d6-50450c6c5561",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "Call this for knowledge about the latest entity risk score and the inputs that contributed to the calculation (sorted by 'kibana.alert.risk_score') in the environment, or when answering questions about how critical or risky an entity is. When informing the risk score value for a entity you must use the normalized field 'calculated_score_norm'."
77
}
88
},
9-
"id": "security_ai_prompts-7e4fa357-c793-4b59-a08d-eb0b2afb7ffb",
9+
"id": "security_ai_prompts-0c781c7f-9ff9-4335-a0e2-6e5508ac8fa0",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "Research"
77
}
88
},
9-
"id": "security_ai_prompts-04f42079-7f27-4892-8c63-4c500e5821c4",
9+
"id": "security_ai_prompts-1474ef6a-9da0-4871-87e6-eaf38b486699",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "A link to documented remediation steps for the policy response failure"
77
}
88
},
9-
"id": "security_ai_prompts-c2198fab-2091-4eb3-8aec-c9b0e06c26b5",
9+
"id": "security_ai_prompts-174eadbe-d322-4f74-af55-eb9c49ce9d24",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@
66
"default": "You are a security analyst and expert in resolving security incidents. Your role is to assist by answering questions about Elastic Security. Do not answer questions unrelated to Elastic Security. If available, use the Knowledge History provided to try and answer the question. If not provided, you can try and query for additional knowledge via the KnowledgeBaseRetrievalTool. {citations_prompt} \n{formattedTime}"
77
}
88
},
9-
"id": "security_ai_prompts-546b95da-5d4c-4bb8-9e89-1550045a1054",
9+
"id": "security_ai_prompts-18f052ce-6a1c-408b-bedc-325189facd8d",
1010
"type": "security-ai-prompt"
1111
}
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"attributes": {
3+
"promptId": "entityDetailsHighlights",
4+
"promptGroupId": "aiForEntityDetails",
5+
"prompt": {
6+
"default": "Generate markdown text with most important information for entity so a Security analyst can act. Your response should take all the important elements of the entity into consideration. Limit your response to 500 characters. Only reply with the required sections, and nothing else.\n ### Format \n Return a string with markdown text without any explanations, or variable assignments. Do **not** wrap the output in triple backticks. \n The result must be a list of bullet points, nothing more.\n Generate summaries for the following sections, but omit any section that if the information isn't available in the context:\n - Risk score: Summarize the entity's risk score and the main factors contributing to it.\n - Criticality: Note the entity's criticality level and its impact on the risk score.\n - Vulnerabilities: Summarize any significant Vulnerability and briefly explain why it is significant.\n - Anomalies: Summarize unusual activities or anomalies detected for the entity and briefly explain why it is significant. \n The generated data **MUST** follow this pattern:\n \"\"\"- **{title1}**: {description1}\n - **{title2}**: {description2}\n ...\n - **{titleN}**: {descriptionN}\n \n **Recommended action**: {description}\"\"\"\n \n **Strict rules**:\n _ Only reply with the required sections, and nothing else.\n - Limit your total response to 500 characters.\n - Never return an section which there is no data available in the context.\n - Use inline code (backticks) for technical values like file paths, process names, arguments, etc.\n - Recommended action title should be bold and text should be inline. \n - **Do not** include any extra explanation, reasoning or text.\n "
7+
}
8+
},
9+
"id": "security_ai_prompts-1b3525c5-4a67-4578-b9e7-2e15b457f21e",
10+
"type": "security-ai-prompt"
11+
}

0 commit comments

Comments
 (0)