AI steps

AI steps let workflows call a large language model (LLM) for reasoning, classification, summarization, or agent-driven execution. All four AI step types share a connector-based auth model: configure a generative AI connector in Kibana, then reference it by ID from a workflow step. When connector-id is omitted, the default connector configured for the workflow is used.

• ai.prompt: Send a prompt to a model and receive a response. Supports structured output with a JSON Schema.
• ai.classify: Classify input into a fixed set of categories.
• ai.summarize: Generate a summary of the provided content.
• ai.agent: Invoke an Elastic Agent Builder agent as a workflow step.

Call an LLM with a prompt. Supports optional structured output through a JSON Schema.

Output shape:

• Free text: { content: string, metadata: object }
• With schema: { content: <structured object matching schema>, metadata: object }

- name: summarize
  type: ai.prompt
  connector-id: "my-openai"
  with:
    prompt: |
      Summarize this alert in one sentence:
      {{ event.alerts[0] | json }}
		

- name: extract_details
  type: ai.prompt
  connector-id: "my-openai"
  with:
    prompt: "Extract key details from this alert: {{ event.alerts[0] | json }}"
    schema:
      type: "object"
      properties:
        severity:
          type: "string"
          enum: ["low", "medium", "high", "critical"]
        summary:
          type: "string"
        key_indicators:
          type: "array"
          items:
            type: "string"
		

The structured result is available at steps.extract_details.output.content.severity, and so on.

Classify input into one of a fixed set of categories. Optionally includes a rationale and supports multi-label classification.

Output shape:

- name: classify
  type: ai.classify
  connector-id: "my-bedrock"
  with:
    input: "${{ event.alerts[0] }}"
    categories: ["true_positive", "false_positive", "needs_investigation"]
    includeRationale: true
    fallbackCategory: "needs_investigation"
		

Summarize content with an LLM. Input can be a string, an array, or an object.

Output shape: { content: string, metadata?: object }.

- name: summary
  type: ai.summarize
  connector-id: "my-gemini"
  with:
    input: "${{ steps.gather.output }}"
    instructions: "Describe the root cause in two or three sentences."
    maxLength: 500
		

Invoke an Elastic Agent Builder agent as a workflow step. Useful when you want a multi-turn agent loop embedded inside a workflow. The agent handles tool selection, reasoning, and response synthesis. The workflow handles pre- and post-processing.

Output shape:

- name: investigate
  type: ai.agent
  agent-id: "security-analyst-agent"
  connector-id: "my-openai"
  create-conversation: true
  with:
    message: |
      Investigate alert {{ event.alerts[0]._id }} and propose next steps.
    schema:
      type: "object"
      properties:
        findings:
          type: "array"
          items:
            type: "string"
        recommended_action:
          type: "string"
		

- name: followup
  type: ai.agent
  agent-id: "security-analyst-agent"
  with:
    conversation_id: "{{ steps.investigate.output.conversation_id }}"
    message: "Apply the recommended action and report back."
		

• Configured AI connectors: Set up the GenAI connector referenced by connector-id.
• Switch step: A common pairing: classify with ai.classify, then dispatch with switch.
• Human-in-the-loop: Pair AI classifications with a reviewer gate for uncertain cases.
• Elastic Agent Builder overview: Concepts behind the agents referenced by ai.agent.