Set up AI features

This page explains how to set up Elastic Security AI features. It covers the required setup, optional setup that control which models and chat experience are available, and setup that applies only to specific features.

Required setup

Elastic Security AI features require a connection to a large language model (LLM), and users need privileges for the features they use.

Connect to an LLM

If your subscription or project feature tier includes Elastic Managed LLMs, they're available by default with no setup required. To connect a different LLM, refer to Configure access to LLMs.

Model performance varies by task. To compare models, refer to the Large language model performance matrix.

Grant privileges

For the privileges that each feature needs, refer to:

AI Assistant: AI Assistant for Security requirements
Attack Discovery: Attack Discovery privileges
Elastic Agent Builder: Permissions and access control in Elastic Agent Builder
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. AlertZero: AlertZero privileges

Optional setup

AI features work with their default settings. Change them to control which models and features are available, or which chat experience each space uses.

Manage available models and features

To limit which connectors and models AI features can use, or to turn AI features off, go to Feature Settings or GenAI Settings (depending on your Elastic Stack version). For details, refer to Manage access to AI features.

Select models for AlertZero

AlertZero has its own model settings, which start with preset models instead of your default model. To learn how the Workers pick a model and how to change it, refer to Select models for the Workers.

Switch chat experiences

Each space uses one of two chat experiences for all its users, either Elastic Agent Builder or AI Assistant for Security. The other experience isn't available in that space. To change which experience a space uses, switch chat experiences in GenAI Settings. For the default experience in each version and the feature differences, refer to Compare Agent Builder and AI Assistant.

Feature-specific setup

The following sections apply to specific features. Only use them if you plan to set up the feature it covers.

Install documentation for Elastic Agent Builder

To give Elastic Agent Builder more context for its answers, install Elastic documentation and Security Labs content. Installed content is available in every space.

To check whether the content is already installed, or to install it, refer to Give Elastic Agent Builder access to Elastic documentation.

Set up the Knowledge Base

The Knowledge Base gives AI Assistant more context, such as your internal documentation or threat research. Elastic Agent Builder doesn't use the Knowledge Base.

The Knowledge Base requires a machine learning node of at least 4 GB. If Elastic Agent Builder is the chat experience in the space, switch to AI Assistant first, because AI Assistant settings aren't available until you do. Then enable the Knowledge Base in each Kibana space where you want to use it. For steps to enable it and add knowledge, refer to AI Assistant Knowledge Base.

Turn on Attack Discovery workflows

To run Attack Discovery from a workflow or from Elastic Agent Builder, turn on the securitySolution:enableAttackDiscoveryWorkflows advanced setting. This setting also lets you configure alert retrieval, generation, and validation in the Attacks view. After you turn it on, users also need Workflows privileges.

Set up AlertZero

AlertZero is off by default, and you set it up in each space where you want it. Its Workers need an AI model, and some also need other features turned on. For what each Worker needs and how to start them, refer to Set up AlertZero.

Features with their own setup

Some features need a separate project or a local install:

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. To use Elastic AI SOC Engine (EASE), create an EASE project, which is a separate Elastic Security Serverless project type.
To use the Security MCP App, install it on your own machine.