Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security solution] ChatBedrockConverse #200042

Merged
merged 26 commits into from
Nov 19, 2024

Conversation

stephmilovic
Copy link
Contributor

@stephmilovic stephmilovic commented Nov 13, 2024

Summary

A couple of weeks ago, we updated our LangChain packages in both 8.x and main branches (PR #198622). This update removed the code on LangChain's end in the BedrockChat chat model that previously invoked non-streaming behavior when tools were provided. As a result, this change broke streaming in Bedrock for the Security Assistant.

Updating from BedrockChat to ChatBedrockConverse

The LangChain team recommends switching from the BedrockChat model to the ChatBedrockConverse model for the following reasons:

  1. Better Support: ChatBedrockConverse is developed and supported directly by LangChain, while BedrockChat was community-developed and is no longer a priority for LangChain.
  2. Amazon’s Recommendation: Amazon recommends using the newer Converse API, which powers ChatBedrockConverse.

Given these points, and because fixing streaming in BedrockChat is non-trivial, we’ve decided to transition to the ChatBedrockConverse model.

Changes in This PR

  • New Model Implementation:

    • Added the ActionsClientChatBedrockConverse model to support both streaming and non-streaming use cases.
    • Updated the .bedrock stack_connector to include two new sub-actions: converse and converseStream. These correlate directly with the Amazon Bedrock APIs of the same names.
  • Error Handling Updates:

    • Enhanced error messaging when streaming is invoked in ActionsClientBedrockChatModel:
      • If someone attempts to invoke streaming with the non-streaming ActionsClientBedrockChatModel, they’ll receive a message instructing them to use ActionsClientChatBedrockConverse instead.
  • Specific Use Case Updates:

    • integration_assistant continues to use ActionsClientBedrockChatModel with streaming explicitly set to false.
    • In siem_migrations, I identified one spot where streaming could theoretically be set to true. However, it is currently always false. To avoid accidental misuse, I removed the parameter entirely.

Comment on lines +29 to +33
this.config.requestHandler = new NodeHttpHandler({
streaming: fields.streaming ?? true,
actionsClient,
connectorId,
});
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jacoblee93 finally got this working by overriding NodeHttpHandler.handle. I'm able to hand back the stream without altering it. However, what tripped me up was non-streaming! It expected that to be encoded too. Both are working now, thanks for your help 🥳

stephmilovic and others added 8 commits November 15, 2024 17:29
…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --update'
@stephmilovic stephmilovic marked this pull request as ready for review November 19, 2024 16:31
@stephmilovic stephmilovic requested review from a team as code owners November 19, 2024 16:31
@stephmilovic stephmilovic requested a review from a team as a code owner November 19, 2024 16:31
@stephmilovic stephmilovic added release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v8.17.0 labels Nov 19, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Copy link
Contributor

@semd semd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes to SIEM migrations LGTM. Thanks Steph

Copy link
Contributor

@adcoelho adcoelho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

response-ops OK

@stephmilovic stephmilovic added the ci:cloud-deploy Create or update a Cloud deployment label Nov 19, 2024
Copy link
Member

@pmuellr pmuellr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ResponseOps changes LGTM

@stephmilovic stephmilovic enabled auto-merge (squash) November 19, 2024 18:34
@stephmilovic
Copy link
Contributor Author

@elasticmachine merge upstream

@elasticmachine
Copy link
Contributor

elasticmachine commented Nov 19, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #81 / task_manager not registered task types "before all" hook for "should successfully schedule registered tasks, not claim unregistered tasks and mark removed task types as unrecognized"

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
stackConnectors 58.3KB 58.3KB +57.0B

History

@stephmilovic stephmilovic merged commit 755ef31 into elastic:main Nov 19, 2024
46 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11921469204

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 19, 2024
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Nov 19, 2024
…200817)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security solution] `ChatBedrockConverse`
(#200042)](#200042)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Steph
Milovic","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-19T20:45:31Z","message":"[Security
solution] `ChatBedrockConverse`
(#200042)","sha":"755ef312f2d533117ce3f614f8586e9c4db657be","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:
SecuritySolution","ci:cloud-deploy","Team:Security Generative
AI","backport:version","v8.17.0"],"title":"[Security solution]
`ChatBedrockConverse`","number":200042,"url":"https://github.com/elastic/kibana/pull/200042","mergeCommit":{"message":"[Security
solution] `ChatBedrockConverse`
(#200042)","sha":"755ef312f2d533117ce3f614f8586e9c4db657be"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/200042","number":200042,"mergeCommit":{"message":"[Security
solution] `ChatBedrockConverse`
(#200042)","sha":"755ef312f2d533117ce3f614f8586e9c4db657be"}},{"branch":"8.x","label":"v8.17.0","branchLabelMappingKey":"^v8.17.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Steph Milovic <[email protected]>
@muskangulati-qasource
Copy link

muskangulati-qasource commented Nov 22, 2024

Hi @MadameSheema,

We have tested this ticket for the Amazon Bedrock Connector on the latest 8.17.0 SNAPSHOT build and below are our observations:

Build details

VERSION: 8.17.0
BUILD: 80340
COMMIT: c900805ed0e25991335bc9779a62d01c6369be8a

Observations and screenshots

  • Able to add Amazon Bedrock connector with the credentials shared [here] :(https://p.elstc.co/paste/QJ4OBJZ+#4KxOyQQWPC7D+Vs2MrJbGIb80lKAlJDZLcg8NEbFbwI) 🟢

  • On the attack Discovery tab, the connector is successfully added and available for testing 🟢
    image

  • Successfully generated attack discovery entries with the Amazon Bedrock connector 🟢
    image

  • Asked questions from AI Assistance using the Bedrock 🟢
    image

  • Asked AI assistant using bedrock to remember information 🟢
    image

  • Asked query on the basis of saved doc 🟢
    image

Please let us know if anything else is required to be added to the testing scenarios.

Thank you!

paulinashakirova pushed a commit to paulinashakirova/kibana that referenced this pull request Nov 26, 2024
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:version Backport to applied version labels ci:cloud-deploy Create or update a Cloud deployment release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.17.0 v9.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants