[AlertZero] Attack Discovery Worker: workflow skeleton and step wiring - #290732
Open
andrew-goldstein wants to merge 1 commit into
Open
[AlertZero] Attack Discovery Worker: workflow skeleton and step wiring#290732andrew-goldstein wants to merge 1 commit into
andrew-goldstein wants to merge 1 commit into
Conversation
…ring This PR implements [elastic#19276](elastic/security-team#19276) to replace the Attack Discovery worker's `console` stub with two new managed workflows: 1) `Attack Discovery Runner` - Runs Attack Discovery generation, then fans out the generated discoveries to the review workflow 2) `Attack Discovery Review` - Reviews one Attack Discovery: opens an Investigation, runs FP/TP analysis, and applies the resulting verdict Both of the workflows above have stub implementations of their steps. 3) This PR removes the Attack discovery run workflow step's 90s soft deadline. Sync mode now runs to completion instead of returning status: 'pending' at 90s, so a workflow calling this step needs a timeout above the pipeline's 30m budget (`run_example.yaml` updated from 10m to 35m). ### How it works #### 1) Users configure the Attack discovery worker's schedule in AlertZero  _Above: The Attack Discovery worker's schedule config_ #### 2) The per-space `Attack Discovery` workflow is invoked by the schedule It `workflow.execute`s the `Attack Discovery Runner` workflow:  _Above: The scheduled `floor_attack_discovery.yaml` workflow executes the `Attack Discovery Runner` workflow_ #### 3) The `Attack Discovery Runner` workflow generates discoveries and batches reviews The `Attack Discovery Runner` workflow generates discoveries via the `security.attack-discovery.run` step. After generating the discoveries, the `Attack Discovery Runner` workflow fans out each generated discovery to a separate invocation of the `Attack Discovery Review` workflow:  _Above: The `attack_discovery_runner.yaml` workflow generates discoveries and invokes the `Attack Discovery Review` workflow for each generation, in batches of parallel runs_ The following example shows the runner generated 8 discoveries, and invoked 8 review workflows:  _Above: The runner invoked 8 review workflows in paralell_ #### 4) The `Attack Discovery Review` workflow reviews one Attack Discovery: opens an Investigation, runs FP/TP analysis, and applies the resulting verdict  _Above: The `attack_discovery_review.yaml` workflow opens an Investigation, runs FP/TP analysis, and applies the resulting verdict_ An example of a single review result is shown below:  _Above: An example review result_ ### Feature flags The following entries in `config/kibana.dev.yml` are required for desk testing: ```yaml xpack.alertzero.enabled: true xpack.agenticInvestigations.enabled: true uiSettings.overrides: securitySolution:enableAttackDiscoveryWorkflows: true workflows:ui:showManagedWorkflows: true ``` ### Out of scope - Alert batching for generation — `elastic#18967` - The real FP/TP analysis workflow — `elastic#19211` - Investigation creation logic — `elastic#19022` - Outcome application — `elastic#19214` _Created with Cursor, Opus 5, Grok 4.6_
andrew-goldstein
added
release_note:skip
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
botelastic
Bot
added
the
Team:One Workflow
|
🤖 Jobs for this PR can be triggered through checkboxes. 🚧
ℹ️ To trigger the CI, please tick the checkbox below 👇
|
Contributor
Author
Files by Code Ownerelastic/security-solution, elastic/workflows-eng
elastic/workflows-eng
|
Contributor
💛 Build succeeded, but was flaky
Failed CI Steps
Metrics [docs]
Test Failures
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[AlertZero] Attack Discovery Worker: workflow skeleton and step wiring
This PR implements #19276 to replace the Attack Discovery worker's
consolestub with two new managed workflows:Attack Discovery Runner- Runs Attack Discovery generation, then fans out the generated discoveries to the review workflowAttack Discovery Review- Reviews one Attack Discovery: opens an Investigation, runs FP/TP analysis, andapplies the resulting verdict
Both of the workflows above have stub implementations of their steps.
run_example.yamlis updated from 10m to 35m).How it works
1) Users configure the Attack discovery worker's schedule in AlertZero
Above: The Attack Discovery worker's schedule config
2) The per-space
Attack Discoveryworkflow is invoked by the scheduleIt
workflow.executes theAttack Discovery Runnerworkflow:Above: The scheduled
floor_attack_discovery.yamlworkflow executes theAttack Discovery Runnerworkflow3) The
Attack Discovery Runnerworkflow generates discoveries and batches reviewsThe
Attack Discovery Runnerworkflow generates discoveries via thesecurity.attack-discovery.runstep.After generating the discoveries, the
Attack Discovery Runnerworkflow fans out each generated discovery to a separate invocation of theAttack Discovery Reviewworkflow:Above: The
attack_discovery_runner.yamlworkflow generates discoveries and invokes theAttack Discovery Reviewworkflow for each generation, in batches of parallel runsThe following example shows the runner generated 8 discoveries, and invoked 8 review workflows:
Above: The runner invoked 8 review workflows in paralell
4) The
Attack Discovery Reviewworkflow reviews one Attack Discovery: opens an Investigation, runs FP/TP analysis, and applies the resulting verdictAbove: The
attack_discovery_review.yamlworkflow opens an Investigation, runs FP/TP analysis, and applies the resulting verdictAn example of a single review result is shown below:
Above: An example review result
Feature flags
The following entries in
config/kibana.dev.ymlare required for desk testing:Out of scope
#18967#19211#19022#19214Created with Cursor, Opus 5, Grok 4.6