[Security AI] Out of band prompts

src/core/server/integration_tests/saved_objects/migrations/group3/type_registrations.test.ts

@@ -123,6 +123,7 @@ const previouslyRegisteredTypes = [
   'search',
   'search-session',
   'search-telemetry',
+  'security-ai-prompt',
   'security-rule',
   'security-solution-signals-migration',
   'risk-engine-configuration',

x-pack/platform/plugins/shared/fleet/.storybook/context/fixtures/integration.nginx.ts

@@ -251,6 +251,7 @@ export const item: GetInfoResponse['item'] = {
       index_pattern: [],
       lens: [],
       map: [],
+      security_ai_prompt: [],
       security_rule: [],
       csp_rule_template: [],
       tag: [],

x-pack/platform/plugins/shared/fleet/.storybook/context/fixtures/integration.okta.ts

@@ -106,6 +106,7 @@ export const item: GetInfoResponse['item'] = {
       ml_module: [],
       osquery_pack_asset: [],
       osquery_saved_query: [],
+      security_ai_prompt: [],
       security_rule: [],
       csp_rule_template: [],
       tag: [],

x-pack/platform/plugins/shared/fleet/common/services/package_to_package_policy.test.ts

@@ -33,6 +33,7 @@ describe('Fleet - packageToPackagePolicy', () => {
         map: [],
         lens: [],
         ml_module: [],
+        security_ai_prompt: [],
         security_rule: [],
         tag: [],
         osquery_pack_asset: [],

x-pack/platform/plugins/shared/fleet/common/types/models/epm.ts

@@ -59,6 +59,7 @@ export enum KibanaAssetType {
   indexPattern = 'index_pattern',
   map = 'map',
   mlModule = 'ml_module',
+  securityAIPrompt = 'security_ai_prompt',
   securityRule = 'security_rule',
   cloudSecurityPostureRuleTemplate = 'csp_rule_template',
   osqueryPackAsset = 'osquery_pack_asset',
@@ -77,6 +78,7 @@ export enum KibanaSavedObjectType {
   indexPattern = 'index-pattern',
   map = 'map',
   mlModule = 'ml-module',
+  securityAIPrompt = 'security-ai-prompt',
   securityRule = 'security-rule',
   cloudSecurityPostureRuleTemplate = 'csp-rule-template',
   osqueryPackAsset = 'osquery-pack-asset',

x-pack/platform/plugins/shared/fleet/public/applications/integrations/sections/epm/constants.tsx

@@ -47,6 +47,12 @@ export const AssetTitleMap: Record<
   map: i18n.translate('xpack.fleet.epm.assetTitles.maps', {
     defaultMessage: 'Maps',
   }),
+  'security-ai-prompt': i18n.translate('xpack.fleet.epm.assetTitles.securityAIPrompt', {
+    defaultMessage: 'Security AI prompt',
+  }),
+  security_ai_prompt: i18n.translate('xpack.fleet.epm.assetTitles.securityAIPrompt', {
+    defaultMessage: 'Security AI prompt',
+  }),
   'security-rule': i18n.translate('xpack.fleet.epm.assetTitles.securityRules', {
     defaultMessage: 'Security rules',
   }),

x-pack/platform/plugins/shared/fleet/server/routes/epm/index.test.ts

@@ -193,6 +193,7 @@ describe('schema validation', () => {
         map: [],
         index_pattern: [],
         ml_module: [],
+        security_ai_prompt: [],
         security_rule: [],
         tag: [],
         csp_rule_template: [],

x-pack/platform/plugins/shared/fleet/server/services/agent_policies/package_policies_to_agent_permissions.test.ts

@@ -38,6 +38,7 @@ packageInfoCache.set('test_package-0.0.0', {
       index_pattern: [],
       map: [],
       lens: [],
+      security_ai_prompt: [],
       security_rule: [],
       ml_module: [],
       tag: [],
@@ -122,6 +123,7 @@ packageInfoCache.set('osquery_manager-0.3.0', {
       index_pattern: [],
       map: [],
       lens: [],
+      security_ai_prompt: [],
       security_rule: [],
       ml_module: [],
       tag: [],
@@ -172,6 +174,7 @@ packageInfoCache.set('profiler_symbolizer-8.8.0-preview', {
       index_pattern: [],
       map: [],
       lens: [],
+      security_ai_prompt: [],
       security_rule: [],
       ml_module: [],
       tag: [],
@@ -222,6 +225,7 @@ packageInfoCache.set('profiler_collector-8.9.0-preview', {
       index_pattern: [],
       map: [],
       lens: [],
+      security_ai_prompt: [],
       security_rule: [],
       ml_module: [],
       tag: [],
@@ -264,6 +268,7 @@ packageInfoCache.set('apm-8.9.0-preview', {
       index_pattern: [],
       map: [],
       lens: [],
+      security_ai_prompt: [],
       security_rule: [],
       ml_module: [],
       tag: [],
@@ -306,6 +311,7 @@ packageInfoCache.set('elastic_connectors-1.0.0', {
       index_pattern: [],
       map: [],
       lens: [],
+      security_ai_prompt: [],
       security_rule: [],
       ml_module: [],
       tag: [],

x-pack/platform/plugins/shared/fleet/server/services/epm/kibana/assets/install.ts

@@ -33,9 +33,10 @@ import { deleteKibanaSavedObjectsAssets } from '../../packages/remove';
 import { FleetError, KibanaSOReferenceError } from '../../../../errors';
 import { withPackageSpan } from '../../packages/utils';
 
+import { appContextService } from '../../..';
+
 import { tagKibanaAssets } from './tag_assets';
 import { getSpaceAwareSaveobjectsClients } from './saved_objects';
-import { appContextService } from '../../..';
 
 const MAX_ASSETS_TO_INSTALL_IN_PARALLEL = 1000;
 
@@ -70,6 +71,7 @@ export const KibanaSavedObjectTypeMapping: Record<KibanaAssetType, KibanaSavedOb
   [KibanaAssetType.visualization]: KibanaSavedObjectType.visualization,
   [KibanaAssetType.lens]: KibanaSavedObjectType.lens,
   [KibanaAssetType.mlModule]: KibanaSavedObjectType.mlModule,
+  [KibanaAssetType.securityAIPrompt]: KibanaSavedObjectType.securityAIPrompt,
   [KibanaAssetType.securityRule]: KibanaSavedObjectType.securityRule,
   [KibanaAssetType.cloudSecurityPostureRuleTemplate]:
     KibanaSavedObjectType.cloudSecurityPostureRuleTemplate,

x-pack/solutions/security/plugins/elastic_assistant/common/constants.ts

@@ -31,3 +31,6 @@ export const CAPABILITIES = `${BASE_PATH}/capabilities`;
  Licensing requirements
  */
 export const MINIMUM_AI_ASSISTANT_LICENSE = 'enterprise' as const;
+
+// Saved Objects
+export const promptSavedObjectType = 'security-ai-prompt';

x-pack/solutions/security/plugins/elastic_assistant/server/lib/langchain/executors/types.ts

@@ -18,6 +18,7 @@ import type { InferenceServerStart } from '@kbn/inference-plugin/server';
 import { AnalyticsServiceSetup } from '@kbn/core-analytics-server';
 import { TelemetryParams } from '@kbn/langchain/server/tracers/telemetry/telemetry_tracer';
 import type { LlmTasksPluginStart } from '@kbn/llm-tasks-plugin/server';
+import { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
 import { ResponseBody } from '../types';
 import type { AssistantTool } from '../../../types';
 import { AIAssistantKnowledgeBaseDataClient } from '../../../ai_assistant_data_clients/knowledge_base';
@@ -57,6 +58,7 @@ export interface AgentExecutorParams<T extends boolean> {
   onLlmResponse?: OnLlmResponse;
   request: KibanaRequest<unknown, unknown, ExecuteConnectorRequestBody>;
   response?: KibanaResponseFactory;
+  savedObjectsClient: SavedObjectsClientContract;
   size?: number;
   systemPrompt?: string;
   telemetry: AnalyticsServiceSetup;

x-pack/solutions/security/plugins/elastic_assistant/server/lib/langchain/graphs/default_assistant_graph/index.ts

@@ -14,6 +14,7 @@ import {
 } from 'langchain/agents';
 import { APMTracer } from '@kbn/langchain/server/tracers/apm';
 import { TelemetryTracer } from '@kbn/langchain/server/tracers/telemetry';
+import { getPrompt, promptDictionary } from '../../../prompt/get_prompt';
 import { getLlmClass } from '../../../../routes/utils';
 import { EsAnonymizationFieldsSchema } from '../../../../ai_assistant_data_clients/anonymization_fields/types';
 import { AssistantToolParams } from '../../../../types';
@@ -44,6 +45,7 @@ export const callAssistantGraph: AgentExecutor<true | false> = async ({
   onNewReplacements,
   replacements,
   request,
+  savedObjectsClient,
   size,
   systemPrompt,
   telemetry,
@@ -130,22 +132,29 @@ export const callAssistantGraph: AgentExecutor<true | false> = async ({
     }
   }
 
+  const defaultSystemPrompt = await getPrompt({
+    savedObjectsClient,
+    llm: llmType,
+    // use oss as model when using openai and oss
+    model: llmType === 'openai' && isOssModel ? 'oss' : request.body.model,
+    promptId: promptDictionary.systemPrompt,
+    actionsClient,
+    connectorId,
+  });
+
   const agentRunnable =
     isOpenAI || llmType === 'inference'
       ? await createOpenAIToolsAgent({
           llm: createLlmInstance(),
           tools,
-          prompt: formatPrompt(systemPrompts.openai, systemPrompt),
+          prompt: formatPrompt(defaultSystemPrompt, systemPrompt),
           streamRunnable: isStream,
         })
       : llmType && ['bedrock', 'gemini'].includes(llmType)
       ? await createToolCallingAgent({
           llm: createLlmInstance(),
           tools,
-          prompt:
-            llmType === 'bedrock'
-              ? formatPrompt(systemPrompts.bedrock, systemPrompt)
-              : formatPrompt(systemPrompts.gemini, systemPrompt),
+          prompt: formatPrompt(defaultSystemPrompt, systemPrompt),
           streamRunnable: isStream,
         })
       : // used with OSS models