-
Notifications
You must be signed in to change notification settings - Fork 106
[Security] Attack Discovery scheduling and saved discoveries #2023
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,9 +3,9 @@ mapped_pages: | |
- https://www.elastic.co/guide/en/security/current/attack-discovery.html | ||
- https://www.elastic.co/guide/en/serverless/current/attack-discovery.html | ||
applies_to: | ||
stack: preview | ||
stack: ga | ||
serverless: | ||
security: preview | ||
security: ga | ||
products: | ||
- id: security | ||
- id: cloud-serverless | ||
|
@@ -20,13 +20,6 @@ For a demo, refer to the following video (click to view). | |
[](https://videos.elastic.co/watch/eT92arEbpRddmSM4JeyzdX?) | ||
|
||
|
||
This page describes: | ||
|
||
* [How to generate discoveries](/solutions/security/ai/attack-discovery.md#attack-discovery-generate-discoveries) | ||
* [What information each discovery includes](/solutions/security/ai/attack-discovery.md#attack-discovery-what-info) | ||
* [How you can interact with discoveries to enhance {{elastic-sec}} workflows](/solutions/security/ai/attack-discovery.md#attack-discovery-workflows) | ||
|
||
|
||
## Role-based access control (RBAC) for Attack Discovery [attack-discovery-rbac] | ||
|
||
You need the `Attack Discovery: All` privilege to use Attack Discovery. | ||
|
@@ -54,7 +47,7 @@ Attack Discovery is designed for use with alerts based on data that complies wit | |
The selected fields can now be analyzed the next time you run Attack Discovery. | ||
::: | ||
|
||
## Generate discoveries [attack-discovery-generate-discoveries] | ||
## Generate discoveries manually[attack-discovery-generate-discoveries] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider the following updates in this section; (sorry, GH won't let me comment on the specific lines because they are unchanged):
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. In the What information does each discovery include? section (sorry, GH won't let me comment on the unchanged line numbers), consider updating the following image:
to the following (or a similar) refreshed screenshot, which includes the new status and sharing indicators: There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We will need to add a |
||
|
||
You’ll need to select an LLM connector before you can analyze alerts. Attack Discovery uses the same LLM connectors as [AI Assistant](/solutions/security/ai/ai-assistant.md). To get started: | ||
|
||
|
@@ -106,3 +99,67 @@ There are several ways you can incorporate discoveries into your {{elastic-sec}} | |
:::{image} /solutions/images/security-add-discovery-to-assistant.gif | ||
:alt: Attack Discovery view in AI Assistant | ||
::: | ||
|
||
## Schedule discoveries | ||
|
||
```yaml {applies_to} | ||
stack: ga 9.1 | ||
serverless: ga | ||
``` | ||
|
||
You can define recurring schedules (for example, daily or weekly) to automatically generate attack discoveries without needing manual runs. For example, you can generate discoveries every 24 hours and send a Slack notification to your SecOps channel if discoveries are found. Notifications are sent using configured [connectors](/deploy-manage/manage-connectors.md), such as Slack or email, and you can customize the notification content to tailor alert context to your needs. | ||
|
||
Scheduled discoveries are shared by default with all users in a {{kib}} space. | ||
|
||
:::{note} | ||
You can still generate discoveries manually at any time, regardless of an active schedule. | ||
::: | ||
|
||
To create a new schedule: | ||
|
||
1. Click the gear icon to open the settings menu, then select **Schedule**. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Just a note, this flow will be changed soon. Design team currently finalising mockups where "Schedule" tab will be opened by clicking on a separate button within the main page. |
||
2. Select **Create new schedule**. | ||
3. Enter a name for the new schedule. | ||
4. Select the LLM connector to use for generating discoveries, or add a new one. | ||
5. Use the KQL query bar, time filter, and alerts slider to customize the set of alerts that will be analyzed. | ||
6. Define the schedule's frequency (for example, every 24 hours). | ||
7. Optionally, select the [connectors](/deploy-manage/manage-connectors.md) to use for receiving notifications, and define their actions. | ||
8. Click **Create & enable schedule**. | ||
|
||
After creating new schedules, you can view their status, modify them or delete them from the **Schedule** tab in the settings menu. | ||
|
||
:::{tip} | ||
Scheduled discoveries are shown with a **Scheduled Attack discovery** icon ({icon}`calendar`). Click the icon to view the schedule that created it. | ||
::: | ||
|
||
## View saved discoveries | ||
|
||
```yaml {applies_to} | ||
stack: ga 9.1 | ||
serverless: ga | ||
``` | ||
|
||
Attack discoveries are automatically saved each time you generate them. Once saved, discoveries remain available for later review, reporting, and tracking over time. This allows you to revisit discoveries to monitor trends, maintain audit trails, and support investigations as your environment evolves. | ||
|
||
### Change a discovery's status | ||
|
||
You can set a discovery's status to indicate that it's under active investigation or that it's been resolved. To do this, click **Take action**, then select **Mark as acknowledged** or **Mark as closed**. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Attack discoveries have a new (introduced in This workflow status (of the discovery itself), is separate from the alerts associated with the attack discovery. Consider documenting the option for users to (optionally) update the workflow status of the alerts associated an attack discovery, as illustrated by the following screenshot, which appears when user click the Mark as open | acknowledged | closed Take action menu items: The updated alerts associated with the attack discovery are illustrated by the screenshot below: |
||
|
||
### Take bulk actions | ||
|
||
You can take bulk actions on multiple discoveries, such as bulk-changing their status or adding them to a case. To do this, select the checkboxes next to each discovery, then click **Selected *x* Attack discoveries** and choose the action you want to take. | ||
|
||
### Search and filter saved discoveries | ||
|
||
You can search and filter saved discoveries to help locate relevant findings. | ||
|
||
* Use the search box to perform full-text searches across your generated discoveries. | ||
|
||
* **Visibility**: Use this filter to, for example, show only shared discoveries. | ||
|
||
* **Status**: Filter discoveries by their current status. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider creating a new Sharing Attack discoveries section to document this feature introduced in Consider speaking to the following nuances:
|
||
|
||
* **Connector**: Filter discoveries by connector name. Connectors that are deleted after discoveries have been generated are shown with a **Deleted** tag. | ||
|
||
* Time filter: Adjust the time filter to view discoveries generated within a specific timeframe. | ||
|
Uh oh!
There was an error while loading. Please reload this page.