[Inference] Fix ActionsClientLlm failing with EIS connector IDs by sphilipse · Pull Request #260268 · elastic/kibana

sphilipse · 2026-03-30T14:02:07Z

Summary

After PR #258530 consolidated connector listing, EIS connectors are returned with inference endpoint IDs (e.g. anthropic-claude-3.7-sonnet- chat_completion) as their connectorId rather than Kibana saved object IDs. Attack Discovery and Defend Insights passed these IDs to ActionsClientLlm which used actionsClient.execute(), failing with "Saved object [action/...] not found".

This PR uses a new path when actionTypeId is .inference and an inference client is available. ActionsClientLlm uses its existing isInferenceEndpoint path which calls inferenceClient.chatComplete() instead of actionsClient.execute().

After PR elastic#258530 consolidated connector listing, EIS connectors are returned with inference endpoint IDs (e.g. anthropic-claude-3.7-sonnet- chat_completion) as their connectorId rather than Kibana saved object IDs. Attack Discovery and Defend Insights passed these IDs to ActionsClientLlm which used actionsClient.execute(), failing with "Saved object [action/...] not found". Fix: Thread an InferenceClient from route handlers to ActionsClientLlm. When actionTypeId is .inference and an inference client is available, ActionsClientLlm uses its existing isInferenceEndpoint path which calls inferenceClient.chatComplete() instead of actionsClient.execute(), correctly handling inference endpoint IDs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

macroscopeapp · 2026-03-30T14:07:11Z

Approvability

Verdict: Needs human review

This PR changes how connector IDs are resolved from client-driven to server-driven across multiple security workflows (attack discovery, defend insights, scheduled tasks). The author does not own any of the 32 modified files, which span multiple team domains (@elastic/search-kibana, @elastic/security-generative-ai, @elastic/security-defend-workflows). Designated code owners should review these cross-cutting behavioral changes.

^{You can customize Macroscope's approvability policy. Learn more.}

Move connector validation from client-side useLoadConnectors lookup to server-side resolution via inference.getConnectorById. The server now resolves the authoritative actionTypeId from the connector ID, so the client only needs to send the connectorId. This removes the useLoadConnectors dependency from useAttackDiscovery and ensures inference endpoint IDs (including EIS connectors) are resolved correctly regardless of what the client sends. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

...s/elastic_assistant/server/lib/attack_discovery/schedules/register_schedule/executor.test.ts

...urity/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx

Add getConnectorByIdWithScopedServices to the inference plugin start contract, which accepts pre-scoped actionsClient and esClient instead of a KibanaRequest. This enables background tasks (like the attack discovery schedule executor) to resolve connector types without needing an HTTP request context. The executor now uses this API to resolve the authoritative actionTypeId for the connector, ensuring EIS inference endpoint IDs are handled correctly in scheduled attack discovery generation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When fetchAttackDiscoveries is called with overrideConnectorId (from the settings flyout), look up the connector name via getConnectorNameFromId using the already-loaded aiConnectors list and pass it as overrideConnectorName. The toast now shows the correct connector name for both default and override cases. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

...urity/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx

e40pud

Tested locally and attack discovery schedules work with EIS models now. Thanks for the fix @sphilipse 🚀

...urity/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx

Replace hand-rolled inference mock with inferenceMock.createStartContract() which stays in sync with the InferenceServerStart interface. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

TattdCodeMonkey

Code review only.

x-pack/platform/plugins/shared/inference/server/plugin.ts

TattdCodeMonkey · 2026-03-30T17:59:57Z

x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/helpers.ts

@@ -157,9 +163,15 @@ export function getAssistantToolParams({
    ],
  };

+  const isInferenceEndpoint =
+    apiConfig.actionTypeId === ('.inference' as InferenceConnectorType.Inference) &&


nit: we're doing '.inference' as InferenceConnectorType.Inference in a few places. would be nice to have a constant for this either in this file or somewhere sharable.

Extract createClientWithoutRequest into create_client.ts, encapsulating the ActionsPluginStart and KibanaRequest shims as an implementation detail. The plugin.ts getClientWithoutRequest now delegates cleanly without any type casts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The inference plugin only uses getActionsClientWithRequest from the actions plugin. Define a narrow ActionsClientProvider interface with just that method and use it throughout the internal implementation. This removes the `as unknown as ActionsPluginStart` cast in createClientWithoutRequest, since the wrapper object now directly satisfies the narrower type. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

paul-tavares

LGTM 👍 ( elastic/security-defend-workflows team

cc/ @joeypoon

elasticmachine · 2026-03-30T19:50:18Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 6e88e64

Failed CI Steps

FTR Configs #7

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.5MB	11.5MB	-342.0B

Unknown metric groups

API count

id	before	after	diff
`inference`	69	76	+7

History

…tic#260268) ## Summary After PR elastic#258530 consolidated connector listing, EIS connectors are returned with inference endpoint IDs (e.g. anthropic-claude-3.7-sonnet- chat_completion) as their connectorId rather than Kibana saved object IDs. Attack Discovery and Defend Insights passed these IDs to ActionsClientLlm which used actionsClient.execute(), failing with "Saved object [action/...] not found". This PR uses a new path when actionTypeId is .inference and an inference client is available. ActionsClientLlm uses its existing isInferenceEndpoint path which calls inferenceClient.chatComplete() instead of actionsClient.execute(). --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

@sphilipse

) (#260345) ## Summary Cherry pick #260268 to `deploy-fix@1774851440` After PR #258530 consolidated connector listing, EIS connectors are returned with inference endpoint IDs (e.g. anthropic-claude-3.7-sonnet- chat_completion) as their connectorId rather than Kibana saved object IDs. Attack Discovery and Defend Insights passed these IDs to ActionsClientLlm which used actionsClient.execute(), failing with "Saved object [action/...] not found". This PR uses a new path when actionTypeId is .inference and an inference client is available. ActionsClientLlm uses its existing isInferenceEndpoint path which calls inferenceClient.chatComplete() instead of actionsClient.execute(). cc @sphilipse @pheyos Co-authored-by: Sander Philipse <94373878+sphilipse@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…all code paths to fix EIS connectors After rebasing ff51c50 (Workflows Integration), the inferenceClient threading from PR elastic#260268 was lost. This restores it across all affected code paths so that EIS connectors (actionTypeId='.inference') use inferenceClient.chatComplete() instead of actionsClient.execute(), which fails with 'Saved object not found' for inference endpoint IDs. Gaps fixed: - Gap 1: Legacy public route handler (FF OFF) — adds inferenceClient to generateAndUpdateAttackDiscoveries call - Gap 2: Schedule executor (FF OFF, scheduled runs) — threads getInference lazy getter through definition and executor, uses getClientWithoutRequest/getConnectorByIdWithoutClientRequest for background context - Gap 3: Discoveries plugin inference dependency — adds InferenceServerStart to DiscoveriesPluginStartDeps and inference to optionalPlugins - Gap 4: invokeAttackDiscoveryGraphWithAlerts (FF ON) — adds inferenceClient param, computes isInferenceEndpoint, passes both to ActionsClientLlm - Gap 5: invokeGenerationGraph helper (FF ON) — forwards inferenceClient to invokeAttackDiscoveryGraphWithAlerts - Gap 6: Generate step handler (FF ON) — creates inferenceClient from pluginsStart.inference and passes to invokeGenerationGraph Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…tic#260268) ## Summary After PR elastic#258530 consolidated connector listing, EIS connectors are returned with inference endpoint IDs (e.g. anthropic-claude-3.7-sonnet- chat_completion) as their connectorId rather than Kibana saved object IDs. Attack Discovery and Defend Insights passed these IDs to ActionsClientLlm which used actionsClient.execute(), failing with "Saved object [action/...] not found". This PR uses a new path when actionTypeId is .inference and an inference client is available. ActionsClientLlm uses its existing isInferenceEndpoint path which calls inferenceClient.chatComplete() instead of actionsClient.execute(). --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

sphilipse requested review from a team as code owners March 30, 2026 14:02

sphilipse requested review from gergoabraham and paul-tavares March 30, 2026 14:02

sphilipse added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Search v9.4.0 labels Mar 30, 2026

sphilipse and others added 2 commits March 30, 2026 16:16

Changes from node scripts/eslint_all_files --no-cache --fix

2b6d499

macroscopeapp bot reviewed Mar 30, 2026

View reviewed changes

...s/elastic_assistant/server/lib/attack_discovery/schedules/register_schedule/executor.test.ts Show resolved Hide resolved

sphilipse force-pushed the inference-fix-actionsclient-issue branch from 3c628c7 to 8f38cbc Compare March 30, 2026 15:45

sphilipse requested a review from a team as a code owner March 30, 2026 15:45

sphilipse force-pushed the inference-fix-actionsclient-issue branch 2 times, most recently from 2478f50 to e320a10 Compare March 30, 2026 15:54

macroscopeapp bot reviewed Mar 30, 2026

View reviewed changes

...urity/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx Show resolved Hide resolved

sphilipse force-pushed the inference-fix-actionsclient-issue branch from eb2cc5c to cc041bd Compare March 30, 2026 16:04

sphilipse force-pushed the inference-fix-actionsclient-issue branch from 2c5ec43 to 3a9852e Compare March 30, 2026 16:42

macroscopeapp bot reviewed Mar 30, 2026

View reviewed changes

...urity/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx Show resolved Hide resolved

kibanamachine added 2 commits March 30, 2026 16:58

Changes from node scripts/lint.js --fix

32526cc

Changes from node scripts/lint_ts_projects --fix

85ef7d6

e40pud approved these changes Mar 30, 2026

View reviewed changes

kibanamachine added 2 commits March 30, 2026 17:21

Changes from node scripts/regenerate_moon_projects.js --update

93fe838

Changes from node scripts/eslint_all_files --no-cache --fix

f795d31

macroscopeapp bot reviewed Mar 30, 2026

View reviewed changes

...urity/plugins/security_solution/public/attack_discovery/pages/use_attack_discovery/index.tsx Show resolved Hide resolved

Fix type error: use inferenceMock instead of manual mock object

fd385f6

Replace hand-rolled inference mock with inferenceMock.createStartContract() which stays in sync with the InferenceServerStart interface. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sphilipse requested a review from a team as a code owner March 30, 2026 18:00

TattdCodeMonkey approved these changes Mar 30, 2026

View reviewed changes

sphilipse and others added 2 commits March 30, 2026 20:05

sphilipse enabled auto-merge (squash) March 30, 2026 18:11

Changes from node scripts/eslint_all_files --no-cache --fix

6e88e64

paul-tavares approved these changes Mar 30, 2026

View reviewed changes

e40pud approved these changes Mar 30, 2026

View reviewed changes

sphilipse disabled auto-merge March 30, 2026 19:46

sphilipse enabled auto-merge (squash) March 30, 2026 19:46

sphilipse merged commit 370a61a into elastic:main Mar 30, 2026
19 checks passed

e40pud mentioned this pull request Mar 30, 2026

[Inference] Fix ActionsClientLlm failing with EIS connector IDs (#260268) #260345

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Inference] Fix ActionsClientLlm failing with EIS connector IDs#260268

[Inference] Fix ActionsClientLlm failing with EIS connector IDs#260268
sphilipse merged 13 commits intoelastic:mainfrom
sphilipse:inference-fix-actionsclient-issue

sphilipse commented Mar 30, 2026

Uh oh!

macroscopeapp bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

e40pud left a comment

Uh oh!

Uh oh!

TattdCodeMonkey left a comment

Uh oh!

Uh oh!

Uh oh!

TattdCodeMonkey Mar 30, 2026

Uh oh!

paul-tavares left a comment

Uh oh!

Uh oh!

elasticmachine commented Mar 30, 2026

API count

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

sphilipse commented Mar 30, 2026

Summary

Uh oh!

macroscopeapp bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

Uh oh!

Uh oh!

Uh oh!

e40pud left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TattdCodeMonkey left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TattdCodeMonkey Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

paul-tavares left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Mar 30, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

API count

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

macroscopeapp bot commented Mar 30, 2026 •

edited

Loading