search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.71k stars 8.13k forks source link

[Security GenAI] Assistant Anonymization feature anonymizes fields with the same values regardless of how they're configured #183571

Open peluja1012 opened 4 months ago

peluja1012 commented 4 months ago

Describe the bug: When configuring anonymization and one field is set to anonymized and another field to non-anonymized, the non-anonymized setting is ignored when the value of the two fields is the same. For example, if the value for both user.name and event.user.name is foo, and user.name is set to anonymized and event.user.name is set to non-anonymized, then both values will be anonymized by the assistant, thus ignoring the setting of event.user.name.

Kibana/Elasticsearch Stack version: v 8.14.0 BC3

Steps to reproduce:

  1. Open the AI Assistant from the Alert Detail page.
  2. Add the alert as context to the conversation.
  3. Edit the anonymization settings for that alert.
  4. Find two fields that have the same value. Set one field to anonymized Yes and the other to anonymized No. Save the settings.
  5. Refresh the page.
  6. Open the same alert, then open the AI Assistant, then add the alert as context, then send a message.
  7. Look at the context of the message sent and click on the Show Anonymized toggle at the top.
  8. Notice that both field values are anonymized, even though you set one of the fields to No.
image image
elasticmachine commented 4 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

YulNaumenko commented 4 weeks ago

@peluja1012 if user didn't select Update presets, the changes will be applied only to the current message which includes the alert:

Image

I recommend to close the bug and open UX enhensment ticket if you think the current UX is not clear.