[Security solution] Add additional properties to attack discovery telemetry

elastic / kibana

Your window into the Elastic Stack

https://www.elastic.co/products/kibana

Other

19.35k stars 7.98k forks source link

[Security solution] Add additional properties to attack discovery telemetry #182249

Closed stephmilovic closed 2 weeks ago

stephmilovic commented 2 weeks ago

Summary

Adds 3 new properties to the reportAttackDiscoveriesGenerated telemetry event: durationMs, alertsCount, and configuredAlertsCount. These fields represent how long the request took, how many alerts were used for the generation, and how many alerts were configured by the user for the generation.

I also added the provider and model arguments which were already defined, but not passed. Here is an example of what this looks like for Bedrock and Azure:

CODEOWNERS change

Added the attack_discovery dir to be under @elastic/security-generative-ai ownership 👍

elasticmachine commented 2 weeks ago

Pinging @elastic/security-solution (Team: SecuritySolution)

kibana-ci commented 2 weeks ago

:green_heart: Build Succeeded

Buildkite Build
Commit: a6c287b4672c3ee4b60f392a7fb56d9589d53d31

The CI Stats report is too large to be displayed here, check out the CI build annotation for this information.

History

:broken_heart: Build #207378 failed dd02014ea8c6da4051f25fee8bafd5959e353f10
:yellow_heart: Build #207328 was flaky 3be4b04fe6465a5084b2337360be31aa1e66cef7
:broken_heart: Build #207320 failed 65f3ee3c8461e94113fffcaf4ca16819d9a72b7c
:green_heart: Build #207251 succeeded 16758f5bed38e73e35b9067404f48fe8e29475ea
:broken_heart: Build #207242 failed 161580503b54e15bbb386c667d4bf371a1357005

To update your PR or re-run it, just comment with: @elasticmachine merge upstream

kibanamachine commented 2 weeks ago

💔 All backports failed

Status	Branch	Result
❌	8.14	Backport failed because of merge conflicts You might need to backport the following PRs to 8.14: - Don't render exceptions flyout if data is loading (#181588) - [Obs AI Assistant] register alert details context in observability plugin (#181501) - [Security Solution][Endpoint] Add validation to ensure a SentinelOne agent ID exists when enabling the `Respond` Take Action option (#182158) - [Obs AI Assistant] Remove unneeded plugin references (#182116)

Manual backport

To create the backport manually run:

node scripts/backport --pr 182249

Questions ?

Please refer to the Backport tool documentation

stephmilovic commented 1 week ago

💚 All backports created successfully

Status	Branch	Result
✅	8.14

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation