[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation #209314

KDKHD · 2025-02-03T14:26:27Z

Summary

Fixes https://github.com/elastic/kibana-team/issues/1442

This PR replaces a poorly performing regular expression with a constant time string manipulation approach.

Context:
The regex is used to remove all references from a string when a user copies a message from the assistant and when conversation history is passed to the LLM e.g.

"The sky is blue{reference(1234)} and the grass is green{reference(4321)}" -> "The sky is blue and the grass is green"

Changes:

Replace the regular expression inside of removeContentReferences()
Add tests to verify new logic is correct.
Fix a bug in the contentReference markdown parser that was found by @andrew-goldstein here
For alerts page citations, add a filter for open and acknowledge alerts within the last 24 hours here

How to test new regex:

One of the changes in this PR improves the performance of a regex. In real life, no one has ever reached any performance issues with this regex's and I don't think it is realistically possible to reach that limit without other things breaking (i.e. the message sent to/returned by the assistant would need to be so large that it would exceed the context window). Therefore, all we can test is that the functionality still works as expected after this change.

Enable the feature flag

# kibana.dev.yml
xpack.securitySolution.enableExperimental: ['contentReferencesEnabled']

Open the security assistant
Ask the assistant a question about your alerts or a document in your KB. The assistant response should contain citations.
Copy the response to the clipboard using the copy button.

- Your clipboard should contain the response without any citations

How to test the alerts page filter

Ask a question about your open alerts and make sure a citation is returned.
Click on the citation
Verify a new tab is opened and the alerts page is visible with a filter for open and acknowledge alerts and there is a now-24h time window filter.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

See some risk examples
...

…-fix'

KDKHD · 2025-02-03T14:58:09Z

@elasticmachine merge upstream

KDKHD · 2025-02-04T14:47:34Z

...ackages/shared/kbn-elastic-assistant-common/impl/content_references/references/utils.test.ts

+    const endTime = performance.now(); // End timing
+    const executionTime = endTime - startTime; // Time in milliseconds
+
+    expect(executionTime).toBeLessThan(1000); // Assert under 1 second


Executes in < 1ms so this won't become a flakey test.

Executes in < 1ms so this won't become a flakey test.

😂 auto reply from CI: hold my 🍺

Jokes aside, to test this test locally, I restored the original implementation of removeContentReferences:

export const removeContentReferences = (content: string) => { return content.replaceAll(/\{reference$.*?$\}/g, ''); };

and re-ran the test. It failed with:

✕ removesContentReferences does not run in polynomial time (41169 ms) ● utils › removesContentReferences does not run in polynomial time expect(received).toBeLessThan(expected) Expected: < 1000 Received: 41167.3355 38 | const executionTime = endTime - startTime; // Time in milliseconds 39 | > 40 | expect(executionTime).toBeLessThan(1000); // Assert under 1 second | ^ 41 | }); 42 | }); 43 | at Object.toBeLessThan (x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/content_references/references/utils.test.ts:40:27)

After restoring the PR version of removeContentReferences, the test once again passes locally with:

✓ removesContentReferences does not run in polynomial time (2 ms)

KDKHD · 2025-02-04T18:57:42Z

x-pack/solutions/security/plugins/elastic_assistant/server/lib/prompt/prompts.ts

@@ -20,7 +20,7 @@ const BASE_GEMINI_PROMPT =
 const KB_CATCH =
  'If the knowledge base tool gives empty results, do your best to answer the question from the perspective of an expert security analyst.';
 export const GEMINI_SYSTEM_PROMPT = `${BASE_GEMINI_PROMPT} ${KB_CATCH} {include_citations_prompt_placeholder}`;
-export const BEDROCK_SYSTEM_PROMPT = `Use tools as often as possible, as they have access to the latest data and syntax. Never return <thinking> tags in the response, but make sure to include <result> tags content in the response. Do not reflect on the quality of the returned search results in your response. ALWAYS return the exact response from NaturalLanguageESQLTool verbatim in the final response, without adding further description.`;
+export const BEDROCK_SYSTEM_PROMPT = `${DEFAULT_SYSTEM_PROMPT} Use tools as often as possible, as they have access to the latest data and syntax. Never return <thinking> tags in the response, but make sure to include <result> tags content in the response. Do not reflect on the quality of the returned search results in your response. {include_citations_prompt_placeholder} ALWAYS return the exact response from NaturalLanguageESQLTool verbatim in the final response, without adding further description.`;


@stephmilovic

I have added the DEFAULT_SYSTEM_PROMPT to the BEDROCK_SYSTEM_PROMPT.

Regarding the INCLUDE_CITATIONS prompt, I have included it as a langchain prompt template. Making it a templated string has these 2 benefits:

The INCLUDE_CITATIONS prompt can be placed in the middle of one of the other prompts.

The INCLUDE_CITATIONS prompt can be toggled on and off conditionally. This is done here.

I think using a prompt template makes the most sense here as I do not know how else I could incorporate the INCLUDE_CITATIONS prompt using the local_prompt data structure.

…-fix'

andrew-goldstein · 2025-02-05T15:27:17Z

...ackages/shared/kbn-elastic-assistant-common/impl/content_references/references/utils.test.ts

+    ['{reference(1234', '{reference(1234'],
+    ['{reference(1234)', '{reference(1234)'],
+    ['{reference(1234)}{reference(1234)}{reference(1234)}', ''],
+    ['{reference(1234)}reference(1234)}{reference(1234)}', 'reference(1234)}'],


I observed the following unexpected output while desk testing:

I attempted to reproduce it via a test case, but the following test passes:

[ `With a wagging tail and a wet, cold nose,{reference(ccaSI)} A furry friend, from head to toes.{reference(ccaSI)} Loyal companion, always near,{reference(ccaSI)} Chasing squirrels, full of cheer.{reference(ccaSI)} A paw to hold, a gentle nudge,{reference(ccaSI)} A furry alarm, a playful judge.{reference(ccaSI)} From golden retrievers to tiny Chihuahuas,{reference(ccaSI)} Their love's a gift, that always conquers.{reference(ccaSI)} So cherish your dog, with all your might,{reference(ccaSI)} Their love's a beacon, shining bright.{reference(ccaSI)}`, `With a wagging tail and a wet, cold nose, A furry friend, from head to toes. Loyal companion, always near, Chasing squirrels, full of cheer. A paw to hold, a gentle nudge, A furry alarm, a playful judge. From golden retrievers to tiny Chihuahuas, Their love's a gift, that always conquers. So cherish your dog, with all your might, Their love's a beacon, shining bright.`, ],

The unreplaced references are still visible when the conversation is re-opened, and when the Show citations toggle is clicked, as illustrated by the animated gif below:

observation: The poem contains a single entry Knowledge base entry: Favorite Color, however that KB entry does not appear to be related to the poem:

So there are 2 problems here:

The {reference(...)} strings are not getting parsed correctly. This has been fixed here

Irrelevant references are being added. I will tweak the prompts to fix this in a separate PR.

…-fix'

…m:KDKHD/kibana into bug/content-references-regex-performance

…-fix'

…:KDKHD/kibana into bug/content-references-regex-performance

…neous LLM output

…-fix'

elasticmachine · 2025-02-06T19:12:05Z

💚 Build Succeeded

Buildkite Build
Commit: fcfaccd

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	21.6MB	21.6MB	+534.0B

History

💚 Build #274014 succeeded 55ef292
💛 Build #273905 was flaky 4ddac67
💔 Build #273823 failed 92f9d52
💔 Build #273741 failed a399f4f
💔 Build #273721 failed af99911
💔 Build #273681 failed b3fec5d

andrew-goldstein · 2025-02-06T22:55:57Z

...ackages/shared/kbn-elastic-assistant-common/impl/content_references/references/utils.test.ts

+    ['{reference(1234)', '{reference(1234)'],
+    ['{reference(1234)}{reference(1234)}{reference(1234)}', ''],
+    ['{reference(1234)}reference(1234)}{reference(1234)}', 'reference(1234)}'],
+  ])('removesContentReferences from "%s"', async (input: string, expected: string) => {


nit: is async required for the tests in this file?

andrew-goldstein · 2025-02-06T23:01:29Z

x-pack/solutions/security/plugins/elastic_assistant/server/lib/prompt/prompts.test.ts

+    [BEDROCK_SYSTEM_PROMPT, 'You are a security analyst', 1],
+  ])(
+    '"%s" contains "%s" %s times',
+    async (prompt: string, containedString: string, expectedCount: number) => {


nit: Consider removing async

andrew-goldstein · 2025-02-06T23:12:55Z

...ublic/assistant/get_comments/content_reference/components/security_alerts_page_reference.tsx

-        path: `alerts`,
-        openInNewTab: true,
-      });
+      openAlertsPageWithFilters(


Thanks for adding these filters!

…/prompt/prompts.test.ts

andrew-goldstein

Thanks for these updates @KDKHD!
✅ Desk tested locally
LGTM 🚀

kibanamachine · 2025-02-07T09:22:55Z

Starting backport for target branches: 8.18, 9.0

https://github.com/elastic/kibana/actions/runs/13196880901

@andrew-goldstein

…ion with constant time string manipulation (elastic#209314) ## Summary Fixes elastic/kibana-team#1442 This PR replaces a poorly performing regular expression with a constant time string manipulation approach. Context: The regex is used to remove all references from a string when a user copies a message from the assistant and when conversation history is passed to the LLM e.g. ``` "The sky is blue{reference(1234)} and the grass is green{reference(4321)}" -> "The sky is blue and the grass is green" ``` Changes: - Replace the regular expression inside of `removeContentReferences()` - Add tests to verify new logic is correct. - Fix a bug in the contentReference markdown parser that was found by @andrew-goldstein [here](https://github.com/elastic/kibana/pull/209314/files#r1943198510) - For alerts page citations, add a filter for open and acknowledge alerts within the last 24 hours [here](https://github.com/elastic/kibana/pull/209314/files#diff-f17fbe7edfe72943fecbe5ddd8dca6c024a48fe4f90bf4f66650cef16091b769R36) ### How to test new regex: One of the changes in this PR improves the performance of a regex. In real life, no one has ever reached any performance issues with this regex's and I don't think it is realistically possible to reach that limit without other things breaking (i.e. the message sent to/returned by the assistant would need to be so large that it would exceed the context window). Therefore, all we can test is that the functionality still works as expected after this change. - Enable the feature flag ```yaml # kibana.dev.yml xpack.securitySolution.enableExperimental: ['contentReferencesEnabled'] ``` - Open the security assistant - Ask the assistant a question about your alerts or a document in your KB. The assistant response should contain citations. - Copy the response to the clipboard using the copy button. <img width="785" alt="image" src="https://github.com/user-attachments/assets/edded3a3-8cb9-40a8-918e-a9718e7afc22" /> - Your clipboard should contain the response without any citations ### How to test the alerts page filter - Ask a question about your open alerts and make sure a citation is returned. - Click on the citation - Verify a new tab is opened and the alerts page is visible with a filter for open and acknowledge alerts and there is a now-24h time window filter. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 2bf8a24)

@andrew-goldstein

…ion with constant time string manipulation (elastic#209314) ## Summary Fixes elastic/kibana-team#1442 This PR replaces a poorly performing regular expression with a constant time string manipulation approach. Context: The regex is used to remove all references from a string when a user copies a message from the assistant and when conversation history is passed to the LLM e.g. ``` "The sky is blue{reference(1234)} and the grass is green{reference(4321)}" -> "The sky is blue and the grass is green" ``` Changes: - Replace the regular expression inside of `removeContentReferences()` - Add tests to verify new logic is correct. - Fix a bug in the contentReference markdown parser that was found by @andrew-goldstein [here](https://github.com/elastic/kibana/pull/209314/files#r1943198510) - For alerts page citations, add a filter for open and acknowledge alerts within the last 24 hours [here](https://github.com/elastic/kibana/pull/209314/files#diff-f17fbe7edfe72943fecbe5ddd8dca6c024a48fe4f90bf4f66650cef16091b769R36) ### How to test new regex: One of the changes in this PR improves the performance of a regex. In real life, no one has ever reached any performance issues with this regex's and I don't think it is realistically possible to reach that limit without other things breaking (i.e. the message sent to/returned by the assistant would need to be so large that it would exceed the context window). Therefore, all we can test is that the functionality still works as expected after this change. - Enable the feature flag ```yaml # kibana.dev.yml xpack.securitySolution.enableExperimental: ['contentReferencesEnabled'] ``` - Open the security assistant - Ask the assistant a question about your alerts or a document in your KB. The assistant response should contain citations. - Copy the response to the clipboard using the copy button. <img width="785" alt="image" src="https://github.com/user-attachments/assets/edded3a3-8cb9-40a8-918e-a9718e7afc22" /> - Your clipboard should contain the response without any citations ### How to test the alerts page filter - Ask a question about your open alerts and make sure a citation is returned. - Click on the citation - Verify a new tab is opened and the alerts page is visible with a filter for open and acknowledge alerts and there is a now-24h time window filter. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 2bf8a24)

kibanamachine · 2025-02-07T09:28:46Z

💚 All backports created successfully

Status	Branch	Result
✅	8.18
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

KDKHD · 2025-02-07T09:34:01Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@andrew-goldstein

…ion with constant time string manipulation (elastic#209314) ## Summary Fixes elastic/kibana-team#1442 This PR replaces a poorly performing regular expression with a constant time string manipulation approach. Context: The regex is used to remove all references from a string when a user copies a message from the assistant and when conversation history is passed to the LLM e.g. ``` "The sky is blue{reference(1234)} and the grass is green{reference(4321)}" -> "The sky is blue and the grass is green" ``` Changes: - Replace the regular expression inside of `removeContentReferences()` - Add tests to verify new logic is correct. - Fix a bug in the contentReference markdown parser that was found by @andrew-goldstein [here](https://github.com/elastic/kibana/pull/209314/files#r1943198510) - For alerts page citations, add a filter for open and acknowledge alerts within the last 24 hours [here](https://github.com/elastic/kibana/pull/209314/files#diff-f17fbe7edfe72943fecbe5ddd8dca6c024a48fe4f90bf4f66650cef16091b769R36) ### How to test new regex: One of the changes in this PR improves the performance of a regex. In real life, no one has ever reached any performance issues with this regex's and I don't think it is realistically possible to reach that limit without other things breaking (i.e. the message sent to/returned by the assistant would need to be so large that it would exceed the context window). Therefore, all we can test is that the functionality still works as expected after this change. - Enable the feature flag ```yaml # kibana.dev.yml xpack.securitySolution.enableExperimental: ['contentReferencesEnabled'] ``` - Open the security assistant - Ask the assistant a question about your alerts or a document in your KB. The assistant response should contain citations. - Copy the response to the clipboard using the copy button. <img width="785" alt="image" src="https://github.com/user-attachments/assets/edded3a3-8cb9-40a8-918e-a9718e7afc22" /> - Your clipboard should contain the response without any citations ### How to test the alerts page filter - Ask a question about your open alerts and make sure a citation is returned. - Click on the citation - Verify a new tab is opened and the alerts page is visible with a filter for open and acknowledge alerts and there is a now-24h time window filter. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 2bf8a24)

…expression with constant time string manipulation (#209314) (#210145) # Backport This will backport the following commits from `main` to `8.18`: - [[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation (#209314)](#209314)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Kenneth Kreindler <42113355+KDKHD@users.noreply.github.com>

@andrew-goldstein

…ion with constant time string manipulation (elastic#209314) ## Summary Fixes elastic/kibana-team#1442 This PR replaces a poorly performing regular expression with a constant time string manipulation approach. Context: The regex is used to remove all references from a string when a user copies a message from the assistant and when conversation history is passed to the LLM e.g. ``` "The sky is blue{reference(1234)} and the grass is green{reference(4321)}" -> "The sky is blue and the grass is green" ``` Changes: - Replace the regular expression inside of `removeContentReferences()` - Add tests to verify new logic is correct. - Fix a bug in the contentReference markdown parser that was found by @andrew-goldstein [here](https://github.com/elastic/kibana/pull/209314/files#r1943198510) - For alerts page citations, add a filter for open and acknowledge alerts within the last 24 hours [here](https://github.com/elastic/kibana/pull/209314/files#diff-f17fbe7edfe72943fecbe5ddd8dca6c024a48fe4f90bf4f66650cef16091b769R36) ### How to test new regex: One of the changes in this PR improves the performance of a regex. In real life, no one has ever reached any performance issues with this regex's and I don't think it is realistically possible to reach that limit without other things breaking (i.e. the message sent to/returned by the assistant would need to be so large that it would exceed the context window). Therefore, all we can test is that the functionality still works as expected after this change. - Enable the feature flag ```yaml # kibana.dev.yml xpack.securitySolution.enableExperimental: ['contentReferencesEnabled'] ``` - Open the security assistant - Ask the assistant a question about your alerts or a document in your KB. The assistant response should contain citations. - Copy the response to the clipboard using the copy button. <img width="785" alt="image" src="https://github.com/user-attachments/assets/edded3a3-8cb9-40a8-918e-a9718e7afc22" /> - Your clipboard should contain the response without any citations ### How to test the alerts page filter - Ask a question about your open alerts and make sure a citation is returned. - Click on the citation - Verify a new tab is opened and the alerts page is visible with a filter for open and acknowledge alerts and there is a now-24h time window filter. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [X] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [X] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [X] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [X] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…xpression with constant time string manipulation (#209314) (#210147) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation (#209314)](#209314)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

kibanamachine · 2025-02-10T09:49:14Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.

…xpression with constant time string manipulation (#209314) (#210146) # Backport This will backport the following commits from `main` to `9.0`: - [[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation (#209314)](#209314)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Kenneth Kreindler <42113355+KDKHD@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Replace polynomial regular expression with constant string manipulation

8f59b95

KDKHD marked this pull request as ready for review February 3, 2025 14:30

KDKHD requested a review from a team as a code owner February 3, 2025 14:30

KDKHD added release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v8.18.0 v9.1.0 labels Feb 3, 2025

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

b03396a

…-fix'

KDKHD changed the title ~~Replace polynomial regular expression with constant string manipulation~~ [Security Solution] [AI Assistant] Replace polynomial regular expression with constant string manipulation Feb 3, 2025

KDKHD changed the title ~~[Security Solution] [AI Assistant] Replace polynomial regular expression with constant string manipulation~~ [Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation Feb 3, 2025

Merge branch 'main' into bug/content-references-regex-performance

23a2503

KDKHD commented Feb 4, 2025

View reviewed changes

Include missing strings in prompts

edcefc1

KDKHD commented Feb 4, 2025

View reviewed changes

KDKHD requested a review from andrew-goldstein February 4, 2025 19:09

KDKHD and others added 2 commits February 5, 2025 09:35

Add test to citations

196a01d

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

791b965

…-fix'

andrew-goldstein reviewed Feb 5, 2025

View reviewed changes

KDKHD added 2 commits February 5, 2025 16:42

update content reference parser

b3fec5d

lint

3778d7d

KDKHD requested a review from andrew-goldstein February 5, 2025 17:33

kibanamachine and others added 6 commits February 5, 2025 17:43

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

af99911

…-fix'

lint

647fb00

Merge branch 'bug/content-referencest-regex-performance' of github.co…

4e5663e

…m:KDKHD/kibana into bug/content-references-regex-performance

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

a399f4f

…-fix'

test

dd972ff

Merge branch 'bug/content-references-regex-performance' of github.com…

79ea623

…:KDKHD/kibana into bug/content-references-regex-performance

KDKHD and others added 3 commits February 6, 2025 14:33

content reference parser - eat empty references to better handle erro…

5ffbcdf

…neous LLM output

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

55ef292

…-fix'

content reference parser - parse references on new lines correctly

fcfaccd

KDKHD force-pushed the bug/content-references-regex-performance branch from 015ac28 to fcfaccd Compare February 6, 2025 17:21

andrew-goldstein reviewed Feb 6, 2025

View reviewed changes

KDKHD and others added 2 commits February 6, 2025 23:24

Update x-pack/solutions/security/plugins/elastic_assistant/server/lib…

86e9ef3

…/prompt/prompts.test.ts

code review

e5482f0

andrew-goldstein approved these changes Feb 6, 2025

View reviewed changes

KDKHD merged commit 2bf8a24 into elastic:main Feb 7, 2025
10 checks passed

kibanamachine mentioned this pull request Feb 7, 2025

[8.18] [Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation (#209314) #210145

Merged

kibanamachine mentioned this pull request Feb 7, 2025

[9.0] [Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation (#209314) #210146

Merged

KDKHD added the v8.19.0 label Feb 7, 2025

KDKHD mentioned this pull request Feb 7, 2025

[8.x] [Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation (#209314) #210147

Merged

kibanamachine mentioned this pull request Feb 7, 2025

[chrome] Improve breadcrumb extension #209765

Merged

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Feb 10, 2025

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Feb 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation #209314

[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation #209314

KDKHD commented Feb 3, 2025 •

edited by kibanamachine

Loading

KDKHD commented Feb 3, 2025

KDKHD Feb 4, 2025

andrew-goldstein Feb 4, 2025

KDKHD Feb 4, 2025

andrew-goldstein Feb 5, 2025

andrew-goldstein Feb 5, 2025

KDKHD Feb 5, 2025

elasticmachine commented Feb 6, 2025

andrew-goldstein Feb 6, 2025

andrew-goldstein Feb 6, 2025

andrew-goldstein Feb 6, 2025

andrew-goldstein left a comment

kibanamachine commented Feb 7, 2025

kibanamachine commented Feb 7, 2025

KDKHD commented Feb 7, 2025

kibanamachine commented Feb 10, 2025

[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation #209314

[Security Solution] [AI Assistant] Replace polynomial regular expression with constant time string manipulation #209314

Conversation

KDKHD commented Feb 3, 2025 • edited by kibanamachine Loading

Summary

How to test new regex:

How to test the alerts page filter

Checklist

Identify risks

KDKHD commented Feb 3, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Feb 6, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

History

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrew-goldstein left a comment

Choose a reason for hiding this comment

kibanamachine commented Feb 7, 2025

kibanamachine commented Feb 7, 2025

💚 All backports created successfully

Questions ?

KDKHD commented Feb 7, 2025

💚 All backports created successfully

Questions ?

kibanamachine commented Feb 10, 2025

KDKHD commented Feb 3, 2025 •

edited by kibanamachine

Loading