[Request] Attack Discovery Alert Filtering

[dhru42]

Description

What: We're introducing the ability for users to select which alerts are included as context to LLMs via Attack Discovery

Why: Currently users can only select the number of alerts that are sent as context to LLMs (slider between 50-500) where we would send the most recent alerts. Now, users can control which alerts get sent as well as the time window (previously fixed to Last 24hrs). This makes attack discovery usable for past alerts and find coorelations between specific alerts.

Background & resources

• PRs: [Security Solution] [Attack discovery] Alerts filtering kibana#205070
• Issues/metas: https://github.com/elastic/security-team/issues/10139
• Point of contact: @andrew-goldstein @jamesspi
• Test environments:

Which documentation set does this change impact?

ESS and serverless

ESS release

8.18

Serverless release

TBD

Feature differences

n.a

API docs impact

TBD

Prerequisites, privileges, feature flags

TBD

[benironside]

complete