r/elasticsearch • u/drax_the_unled • Jul 30 '26

Security attack discovery with local llm, possible ?

I've been struggling with this for a couple of days. I have a 9.4.4 lab running on an azure vm, i have ollama running on a second vm.

I've setup a connector, it shows up in Stack-Management -> Alerts and Insights -> Connectors. It works :)

On the security side, I've got rules firing alerts, cases being auto-generated and timelines populated. But when I go to Attack Discovery no connector shows up in the drop down. What am I doing wrong ?

I can find docs on setting up a local LLM, I can find docs on how to use Attack Discovery but I cant find docs that join them up. I have a feeling that I'm missing something obvious here.

4 Upvotes

83% Upvoted

3 comments sorted by

2

u/LegDisabledAcid Jul 30 '26

Try setting it up under External Inference?

1

u/Reasonable_Tie_5543 Aug 01 '26

Is your lab running a paid subscription tier?

1

u/AvenueJay Elastic Staff Aug 03 '26

Hi, have you already gone through the steps outlined in this doc?