Bulk prompt actions

Apply a bulk action (create, update, or delete) to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs.

Request URL

edit

POST <kibana host>:<port>/api/security_ai_assistant/prompts/_bulk_action

Request body

edit

A JSON object with the following properties:

Name	Type	Description	Required
`create`	BulkCreateAction[]	Array of prompt objects to create.	No
`delete`	String[]	Array of IDs of the prompts to delete.	No
`update`	BulkUpdateAction[]	Array of prompt objects with the fields to update.	No

BulkCreateAction object

edit

Name	Type	Description	Required
`name`	String	Short prompt title.	Yes
`id`	String	Prompt ID.	Yes
`promptType`	String	Prompt type. Valid values are: `system` `quick`	Yes
`consumer`	String	Solution application that the prompt belongs to. For example `securitySolutionUI`, `ml`	Yes
`content`	String	Prompt text to send to LLM.	Yes
`color`	String	Sets the display color for quick prompts in the UI.	No
`categories`	String[]	Array of prompt categories.	No

BulkUpdateAction object

edit

Name	Type	Description	Required
`id`	String	Prompt ID.	Yes
`content`	String	Prompt text to send to LLM.	No
`color`	String	Sets the display color for quick prompts in the UI.	No
`categories`	String[]	Array of prompts categories.	No

Example requests

edit

Example 1

The following request creates a new quick prompt:

POST api/security_ai_assistant/prompts/_bulk_action
{
  "create": [
    {
      "name": "test",
      "id": "test",
      "content": "some test content",
      "color": "#D36086",
      "categories": [],
      "promptType": "quick",
      "consumer": "securitySolutionUI"
    }
  ]
}

Response code

edit

200: Indicates a successful call.

Response payload

edit

JSON object containing the action’s outcome:

attributes.summary.total: Total number of prompts matching the bulk action
attributes.summary.succeeded: Number of successful outcomes (number of prompts that were created, deleted, or updated)
attributes.summary.failed: Number of failed outcomes
attributes.summary.skipped: Number of prompts that were skipped due to various reasons (explained below)
attributes.results.created: Prompt objects that were created during the action’s execution
attributes.results.updated: Prompt objects that were updated during the action’s execution
attributes.results.deleted: Prompt objects that were deleted during the action’s execution
attributes.results.skipped: Prompt that were skipped during the action’s execution

A prompt can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the update action is used to update a field that already has the specified value. Objects returned in attributes.results.skipped only include a prompt’s id, name, and skip_reason.

{
  "success": true,
  "prompts_count": 1,
  "attributes": {
    "results": {
      "updated": [],
      "created": [
        {
          "timestamp": "2024-08-13T20:24:08.610Z",
          "users": [
            {
              "id": "testuser",
              "name": "elastic"
            }
          ],
          "content": "some test content",
          "updatedAt": "2024-08-13T20:24:08.610Z",
          "id": "0B1pTZEBYaDeA-NhjHej",
          "name": "test",
          "promptType": "quick",
          "color": "#D36086",
          "categories": [],
          "consumer": "securitySolutionUI"
        }
      ],
      "deleted": [],
      "skipped": []
    },
    "summary": {
      "failed": 0,
      "succeeded": 1,
      "skipped": 0,
      "total": 1
    }
  }
}

Example 2: Partial failure

The following request deletes prompt by ID "8bc7dad0-9320-11ec-9265-8b772383a08d" and updates another prompt by ID "2-R12SZEBYaDeA-NhnUyW" with the new values for content, color and categories:

POST api/security_ai_assistant/prompts/_bulk_action
{
  "delete": {
    "ids": [
      "8bc7dad0-9320-11ec-9265-8b772383a08d"
    ]
  },
  "update": [
    {
      "content": "As an expert in security operations and incident response, provide a breakdown of the attached alert and summarize what it might mean for my organization.",
      "id": "2-R12SZEBYaDeA-NhnUyW",
      "color": "#F68FBE",
      "categories": [
        "alert"
      ]
    }
  ]
}

Response code

edit

500: Indicates partial bulk action failure.

Response payload

edit

If the processing of any prompts fails, the response outputs a partial error, with the ID and/or name of the affected prompt and the corresponding error message. The response also includes successfully processed prompts, in the same format as a successful 200 request.

{
  "message": "Bulk delete partially failed",
  "status_code": 500,
  "attributes": {
    "errors": [
      {
        "message": "Some error happened here",
        "status_code": 500,
        "prompts": [
          {
            "id": "8bc7dad0-9320-11ec-9265-8b772383a08d",
            "name": "Prompt title"
          }
        ]
      }
    ],
    "results": {
      "updated": [
        {
          "timestamp": "2024-08-13T01:59:56.053Z",
          "users": [
            {
              "id": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
              "name": "elastic"
            }
          ],
          "content": "As an expert in security operations and incident response, provide a breakdown of the attached alert and summarize what it might mean for my organization.",
          "isDefault": true,
          "updatedAt": "2024-08-13T20:45:14.763Z",
          "name": "Alert summarization",
          "promptType": "quick",
          "color": "#F68FBE",
          "categories": [
            "alert"
          ],
          "consumer": "securitySolutionUI"
        }
      ],
      "created": [],
      "deleted": [],
      "skipped": []
    },
    "summary": {
      "failed": 1,
      "succeeded": 1,
      "skipped": 0,
      "total": 2
    }
  }
}

« Find prompts Find anonymization fields »