Set up AI features

This page explains how to set up Elastic Security AI features. It covers the required setup, optional setup that control which models and chat experience are available, and setup that applies only to specific features.

Elastic Security AI features require a connection to a large language model (LLM), and users need privileges for the features they use.

If your subscription or project feature tier includes Elastic Managed LLMs, they're available by default with no setup required. To connect a different LLM, refer to Configure access to LLMs.

Model performance varies by task. To compare models, refer to the Large language model performance matrix.

For the privileges that each feature needs, refer to:

AI features work with their default settings. Change them to control which models and features are available, or which chat experience each space uses.

To limit which connectors and models AI features can use, or to turn AI features off, go to Feature Settings or GenAI Settings (depending on your Elastic Stack version). For details, refer to Manage access to AI features.

Each space uses one of two chat experiences for all its users, either Elastic Agent Builder or AI Assistant for Security. The other experience isn't available in that space. To change which experience a space uses, switch chat experiences in GenAI Settings. For the default experience in each version and the feature differences, refer to Compare Agent Builder and AI Assistant.

The following sections apply to specific features. Only use them if you plan to set up the feature it covers.

To give Elastic Agent Builder more context for its answers, install Elastic documentation and Security Labs content. Installed content is available in every space.

To check whether the content is already installed, or to install it, refer to Give Elastic Agent Builder access to Elastic documentation.

The Knowledge Base gives AI Assistant more context, such as your internal documentation or threat research. Elastic Agent Builder doesn't use the Knowledge Base.

The Knowledge Base requires a machine learning node of at least 4 GB. If Elastic Agent Builder is the chat experience in the space, switch to AI Assistant first, because AI Assistant settings aren't available until you do. Then enable the Knowledge Base in each Kibana space where you want to use it. For steps to enable it and add knowledge, refer to AI Assistant Knowledge Base.

To run Attack Discovery from a workflow or from Elastic Agent Builder, turn on the securitySolution:enableAttackDiscoveryWorkflows advanced setting. This setting also lets you configure alert retrieval, generation, and validation in the Attacks view. After you turn it on, users also need Workflows privileges.

Some features need a separate project or a local install: