---
title: Set up AI features
description: Set up the LLM access and privileges that Elastic Security AI features need, plus optional settings such as the chat experience, the Knowledge Base, and Agent Builder documentation.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/set-up-ai-features
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Set up AI features
This page explains how to set up Elastic Security AI features. It covers the required setup, optional setup that control which models and chat experience are available, and setup that applies only to specific features.

## Required setup

Elastic Security AI features require a connection to a large language model (LLM), and users need privileges for the features they use.

### Connect to an LLM

If your subscription or project feature tier includes [Elastic Managed LLMs](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/elastic-managed-llm), they're available by default with no setup required. To connect a different LLM, refer to [Configure access to LLMs](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/explore-analyze/ai-features/llm-guides/llm-connectors).
Model performance varies by task. To compare models, refer to the [Large language model performance matrix](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/large-language-model-performance-matrix).

### Grant privileges

For the privileges that each feature needs, refer to:
- AI Assistant: [AI Assistant for Security requirements](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/ai-assistant)
- Attack Discovery: [Attack Discovery privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/attack-discovery/grant-access)
- Elastic Agent Builder: [Permissions and access control in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/explore-analyze/ai-features/agent-builder/permissions)


## Optional setup

AI features work with their default settings. Change them to control which models and features are available, or which chat experience each space uses.

### Manage available models and features

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.2
</applies-to>

To limit which connectors and models AI features can use, or to turn AI features off, go to **Feature Settings** or **GenAI Settings** (depending on your Elastic Stack version). For details, refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/explore-analyze/ai-features/manage-access-to-ai-assistant).

### Switch chat experiences

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4
  - Elastic Stack: Preview in 9.3
</applies-to>

Each space uses one of two chat experiences for all its users, either [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/agent-builder/agent-builder) or [AI Assistant for Security](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/ai-assistant). The other experience isn't available in that space. To change which experience a space uses, switch chat experiences in **GenAI Settings**. For the default experience in each version and the feature differences, refer to [Compare Agent Builder and AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/explore-analyze/ai-features/ai-chat-experiences/ai-agent-or-ai-assistant).

## Feature-specific setup

The following sections apply to specific features. Only use them if you plan to set up the feature it covers.

### Install documentation for Elastic Agent Builder

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4
  - Elastic Stack: Preview in 9.3
</applies-to>

To give Elastic Agent Builder more context for its answers, install Elastic documentation and Security Labs content. Installed content is available in every space.
To check whether the content is already installed, or to install it, refer to [Give Elastic Agent Builder access to Elastic documentation](/elastic/docs-content/pull/8715/explore-analyze/ai-features/manage-access-to-ai-assistant#give-agent-builder-access-to-elastic-documentation).

### Set up the Knowledge Base

The Knowledge Base gives AI Assistant more context, such as your internal documentation or threat research. Elastic Agent Builder doesn't use the Knowledge Base.
The Knowledge Base requires a machine learning node of at least 4 GB. If Elastic Agent Builder is the chat experience in the space, [switch to AI Assistant](#set-up-ai-chat) first, because AI Assistant settings aren't available until you do. Then enable the Knowledge Base in each Kibana space where you want to use it. For steps to enable it and add knowledge, refer to [AI Assistant Knowledge Base](/elastic/docs-content/pull/8715/solutions/security/ai/ai-assistant-knowledge-base#enable-knowledge-base).

### Turn on Attack Discovery workflows

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.5
</applies-to>

To run Attack Discovery from a workflow or from Elastic Agent Builder, turn on the [`securitySolution:enableAttackDiscoveryWorkflows`](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-siem-settings) advanced setting. This setting also lets you configure alert retrieval, generation, and validation in the **Attacks** view. After you turn it on, users also need [Workflows privileges](/elastic/docs-content/pull/8715/solutions/security/ai/attack-discovery/grant-access#attack-discovery-workflows-privileges).

### Features with their own setup

Some features need a separate project or a local install:
- <applies-to>Elastic Cloud Serverless: Preview</applies-to> To use [Elastic AI SOC Engine (EASE)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/ai/ease/ease-intro), create an EASE project, which is a separate Elastic Security Serverless project type.
- To use the [Security MCP App](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8715/solutions/security/mcp-app/elastic-security-mcp-app), install it on your own machine.