kibana icon indicating copy to clipboard operation
kibana copied to clipboard

[Agent Builder] Adds Integration Knowledge platform tool

Open spong opened this issue 1 month ago • 2 comments

Summary

Adds an integration knowledge tool to Agent Builder that retrieves documentation from Fleet-installed integrations using semantic search on the .integration_knowledge index. The tool uses the conditional availability pattern and is only available when the integration knowledge index exists.

Changes

  • Added platform.core.integration_knowledge builtin tool to agent_builder_platform that searches Fleet integration documentation
  • Tool is registered in plugin setup() with conditional availability using the availability configuration pattern
  • Availability is checked at runtime via ES search on .integration_knowledge index (using size: 0 query)
  • Returns structured resource results with package name, version, filename, and content

Technical Details

  • Tool registration added to registerTools() in plugin setup() phase, following the same pattern as productDocumentationTool
  • Uses availability configuration with cacheMode: 'space' to conditionally show/hide the tool based on index availability
  • Searches using Elasticsearch semantic search on the content field
  • esClient.asInternalUser is used for both handler execution and availability checking (index permissions require internal user)
  • Results include reference URLs to integration detail pages (/app/integrations/detail/{package_name})

Considerations

  • Tool requires Fleet to have indexed integration knowledge into .integration_knowledge
  • Tool availability is checked per-space and cached for performance
  • No Kibana restart required - tool appears/disappears dynamically based on index availability
  • This is the onechat/Agent Builder equivalent of the existing IntegrationKnowledgeTool in Security Solution's Assistant (https://github.com/elastic/kibana/pull/236197) and Observability Solution's Assistant (https://github.com/elastic/kibana/pull/237085) added in 9.2.

Testing

[!NOTE] You must enable the xpack.fleet.enableExperimental: ["installIntegrationsKnowledge"] feature flag until this PR enabling it by default is merged (https://github.com/elastic/kibana/pull/245080).

  1. Upload this sample system-2.3.3-NEXT.zip package via Integrations > Create new integration
    • The test package just copies the existing docs/README.md to docs/knowledge_base/README.md so that Fleet ingests it into .integrations_knowledge
  2. Create new Agent with the new Integration Knowledge tool and ask questions related to system integrations, such as:
    • How can I collect CPU and memory data for my windows host?
    • What OS can I run the system integration on?
    • What does the system integration do?
  3. Observe that the responses returned contain relevant information that is cited from the system integration.

PR developed with Cursor + Opus 4.5

spong avatar Dec 04 '25 15:12 spong

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine avatar Dec 04 '25 15:12 elasticmachine

:green_heart: Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
onechat 477.3KB 477.4KB +49.0B

History

  • :broken_heart: Build #371554 failed ae46a5d13399006232dc9b5106cbd18f9bc59d90
  • :green_heart: Build #370269 succeeded 5e48bee14df5031975664d4e3f3f38a28cfb6ce0
  • :yellow_heart: Build #369111 was flaky 669dc85038d941f3eb10cd0d6a31cbc032f9d7bb

cc @spong

elasticmachine avatar Dec 11 '25 22:12 elasticmachine