SecurityAiAssistantClient¶

Client for the Kibana Security AI Assistant API.

The Security AI Assistant helps security analysts triage alerts, write queries and investigate incidents through a large language model. This client manages the assistant’s building blocks – conversations, prompts, anonymization fields and Knowledge Base entries – and can request model responses via chat_complete using any AI connector (.gen-ai, .bedrock, .gemini, …) configured in Kibana.

All Security AI Assistant resources are space-scoped: a conversation or prompt created in one space is not visible from another space. Every method accepts an optional space_id to target a specific space.

class kibana._sync.client.security_ai_assistant.SecurityAiAssistantClient(client, default_space_id=None, validate_spaces=True)[source]¶

Bases: NamespaceClient

Client for the Kibana Security AI Assistant API.

The Security AI Assistant helps security analysts triage alerts, write queries and investigate incidents through a large language model. This client manages the assistant’s building blocks – conversations, prompts, anonymization fields and Knowledge Base entries – and can request model responses via chat_complete() using any AI (.gen-ai, .bedrock, .gemini, …) connector configured in Kibana.

All Security AI Assistant resources are space-scoped: every method accepts an optional space_id to target a specific space (None targets the default space or the space the client is scoped to).

Example

>>> from kibana import Kibana
>>> client = Kibana("http://localhost:5601", api_key="...")
>>>
>>> # Create and find conversations
>>> conv = client.security_ai_assistant.create_conversation(
...     title="Suspicious login investigation",
... )
>>> found = client.security_ai_assistant.find_conversations(
...     filter="Suspicious",
... )
>>>
>>> # Ask the model a question through an AI connector
>>> answer = client.security_ai_assistant.chat_complete(
...     connector_id="my-openai-connector",
...     messages=[{"role": "user", "content": "What is a brute force attack?"}],
...     persist=False,
... )
>>> print(answer.body["data"])

Managing Conversations

from kibana import Kibana

client = Kibana("http://localhost:5601", api_key="your_api_key")

# Create a conversation
conv = client.security_ai_assistant.create_conversation(
    title="Suspicious login investigation",
    messages=[
        {
            "content": "Investigate the failed logins on host web-01.",
            "role": "user",
            "timestamp": "2026-01-01T12:00:00Z",
        }
    ],
)
conversation_id = conv.body["id"]

# Search, update and delete conversations
found = client.security_ai_assistant.find_conversations(
    filter="Suspicious", sort_field="created_at", sort_order="desc"
)
client.security_ai_assistant.update_conversation(
    id=conversation_id, title="Suspicious login investigation (triaged)"
)
client.security_ai_assistant.delete_conversation(id=conversation_id)

# Delete every conversation except the ones listed
client.security_ai_assistant.delete_all_conversations(
    excluded_ids=["keep-this-conversation-id"]
)

Prompts and Anonymization Fields

Prompts and anonymization fields are managed through _find and _bulk_action endpoints:

# Bulk-create prompts
result = client.security_ai_assistant.bulk_action_prompts(
    create=[
        {
            "name": "Summarize alerts",
            "content": "Summarize the open alerts of the last 24 hours.",
            "promptType": "quick",
        }
    ],
)
prompt_id = result.body["attributes"]["results"]["created"][0]["id"]

# Update and delete in one bulk call
client.security_ai_assistant.bulk_action_prompts(
    update=[{"id": prompt_id, "content": "Summarize critical alerts."}],
)
client.security_ai_assistant.bulk_action_prompts(
    delete={"ids": [prompt_id]},
)

# Control which fields may be sent to the model (and anonymized)
client.security_ai_assistant.bulk_action_anonymization_fields(
    create=[{"field": "user.name", "allowed": True, "anonymized": True}],
)
fields = client.security_ai_assistant.find_anonymization_fields(
    filter='field: "user.name"'
)

Knowledge Base

# Check and run the Knowledge Base setup (ELSER model + content)
status = client.security_ai_assistant.get_knowledge_base()
if status.body["is_setup_available"]:
    client.security_ai_assistant.setup_knowledge_base(
        ignore_security_labs=True
    )

# Create a document entry the assistant can use as context
entry = client.security_ai_assistant.create_knowledge_base_entry(
    type="document",
    name="Password reset runbook",
    kb_resource="user",
    source="/runbooks/password-reset.md",
    text="To reset a password, open the settings page ...",
)
entry_id = entry.body["id"]

# Find, update, and delete entries
client.security_ai_assistant.find_knowledge_base_entries(per_page=50)
client.security_ai_assistant.update_knowledge_base_entry(
    id=entry_id,
    type="document",
    name="Password reset runbook (v2)",
    kb_resource="user",
    source="/runbooks/password-reset.md",
    text="Updated instructions ...",
)
client.security_ai_assistant.delete_knowledge_base_entry(id=entry_id)

Chatting With the Model

chat_complete routes the messages through a Kibana AI connector. LLM calls can be slow, so raise the request timeout for these calls:

response = client.options(request_timeout=120).security_ai_assistant.chat_complete(
    connector_id="my-openai-connector",
    messages=[
        {"role": "user", "content": "What are common phishing techniques?"}
    ],
    persist=False,
)
print(response.body["data"])

__init__(client, default_space_id=None, validate_spaces=True)[source]¶

Initialize the SecurityAiAssistantClient.

Parameters:

client (Kibana) – The parent Kibana client instance to delegate requests to.
default_space_id (str | None) – Optional default space ID for all operations.
validate_spaces (bool) – Whether to validate space existence before space-scoped operations (default: True).

Example

>>> security_ai_assistant_client = SecurityAiAssistantClient(kibana_client)

create_conversation(*, title, api_config=None, category=None, exclude_from_last_conversation_storage=None, id=None, messages=None, replacements=None, space_id=None, validate_spaces=None)[source]¶

Create a conversation.

POST /api/security_ai_assistant/current_user/conversations. Creates a new Security AI Assistant conversation for the current user, optionally seeded with messages and an LLM API configuration.

Parameters:

title (str) – The conversation title.
api_config (dict[str, Any] | None) – LLM API configuration, e.g. {"connectorId": "...", "actionTypeId": ".gen-ai", "model": "gpt-4", "provider": "OpenAI"}. connectorId and actionTypeId are required inside this object when it is provided.
category (str | None) – The conversation category: assistant or insights.
exclude_from_last_conversation_storage (bool | None) – Exclude this conversation from last-conversation storage.
id (str | None) – Optional caller-specified conversation ID.
messages (list[dict[str, Any]] | None) – The conversation messages. Each message requires content, role (system, user or assistant) and timestamp (ISO 8601).
replacements (dict[str, str] | None) – Replacements object used to anonymize/de-anonymize messages (mapping of replacement token to original value).
space_id (str | None) – Optional space ID to create the conversation in.
validate_spaces (bool | None) – Override space validation setting for this operation.

Returns:

ObjectApiResponse with the created conversation, including its server-assigned id, createdAt, createdBy and users.

Raises:

BadRequestError – If required parameters are missing or invalid.
AuthenticationException – If authentication fails.
AuthorizationException – If insufficient privileges.
SpaceNotFoundError – If the space doesn’t exist and validation is enabled.

Return type:

SecurityAiAssistantClient¶

AsyncSecurityAiAssistantClient¶