[9.0] [Security AI Assistant] Bedrock prompt updates (#213160) (#213479)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security AI Assistant] Bedrock prompt updates
(#213160)](#213160)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Steph
Milovic","email":"stephanie.milovic@elastic.co"},"sourceCommit":{"committedDate":"2025-03-06T19:58:26Z","message":"[Security
AI Assistant] Bedrock prompt updates
(#213160)","sha":"5b8fd8f5c79c492b46493861f3e74795558927f7","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","v9.0.0","Team:Security
Generative
AI","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
AI Assistant] Bedrock prompt
updates","number":213160,"url":"https://github.com/elastic/kibana/pull/213160","mergeCommit":{"message":"[Security
AI Assistant] Bedrock prompt updates
(#213160)","sha":"5b8fd8f5c79c492b46493861f3e74795558927f7"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213160","number":213160,"mergeCommit":{"message":"[Security
AI Assistant] Bedrock prompt updates
(#213160)","sha":"5b8fd8f5c79c492b46493861f3e74795558927f7"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/213475","number":213475,"state":"OPEN"}]}]
BACKPORT-->

x-pack/solutions/security/plugins/elastic_assistant/server/lib/prompt/prompts.ts

@@ -15,7 +15,7 @@ const BASE_GEMINI_PROMPT =
 const KB_CATCH =
   'If the knowledge base tool gives empty results, do your best to answer the question from the perspective of an expert security analyst.';
 export const GEMINI_SYSTEM_PROMPT = `${BASE_GEMINI_PROMPT} ${INCLUDE_CITATIONS} ${KB_CATCH}`;
-export const BEDROCK_SYSTEM_PROMPT = `${DEFAULT_SYSTEM_PROMPT} Use tools as often as possible, as they have access to the latest data and syntax. Never return <thinking> tags in the response, but make sure to include <result> tags content in the response. Do not reflect on the quality of the returned search results in your response. ALWAYS return the exact response from NaturalLanguageESQLTool verbatim in the final response, without adding further description.`;
+export const BEDROCK_SYSTEM_PROMPT = `${DEFAULT_SYSTEM_PROMPT}\n\nUse tools as often as possible, as they have access to the latest data and syntax. Never return <thinking> tags in the response, but make sure to include <result> tags content in the response. Do not reflect on the quality of the returned search results in your response. ALWAYS return the exact response from NaturalLanguageESQLTool verbatim in the final response, without adding further description.\n\n Ensure that the final response always includes all instructions from the tool responses. Never omit earlier parts of the response.`;
 export const GEMINI_USER_PROMPT = `Now, always using the tools at your disposal, step by step, come up with a response to this request:\n\n`;
 
 export const STRUCTURED_SYSTEM_PROMPT = `Respond to the human as helpfully and accurately as possible. ${KNOWLEDGE_HISTORY} ${INCLUDE_CITATIONS} You have access to the following tools:
@@ -137,11 +137,20 @@ export const ATTACK_DISCOVERY_GENERATION_TITLE =
   'A short, no more than 7 words, title for the insight, NOT formatted with special syntax or markdown. This must be as brief as possible.';
 export const ATTACK_DISCOVERY_GENERATION_INSIGHTS = `Insights with markdown that always uses special ${SYNTAX} syntax for field names and values from the source data. ${GOOD_SYNTAX_EXAMPLES} ${BAD_SYNTAX_EXAMPLES}`;
 
-export const BEDROCK_CHAT_TITLE = `You are a helpful assistant for Elastic Security. Assume the following user message is the start of a conversation between you and a user; give this conversation a title based on the content below. DO NOT UNDER ANY CIRCUMSTANCES wrap this title in single or double quotes. This title is shown in a list of conversations to the user, so title it for the user, not for you. Respond with the title only with no other text explaining your response. As an example, for the given MESSAGE, this is the TITLE:
+export const BEDROCK_CHAT_TITLE = `You are a strictly rule-following assistant for Elastic Security.
+Your task is to ONLY generate a short, user-friendly title based on the given user message.
 
-MESSAGE: I am having trouble with the Elastic Security app.
-TITLE: Troubleshooting Elastic Security app issues
-`;
+Instructions (You Must Follow Exactly)
+DO NOT ANSWER the user's question. You are forbidden from doing so.
+Your response MUST contain only the generated title. Nothing else.
+Absolutely NO explanations, disclaimers, or additional text.
+The title must be concise, relevant to the user’s message, and never exceed 100 characters.
+DO NOT wrap the title in quotes or any other formatting.
+Example:
+User Message: "I am having trouble with the Elastic Security app."
+Correct Response: Troubleshooting Elastic Security app issues
+
+Final Rule: If you include anything other than the title, you have failed this task.`;
 
 export const GEMINI_CHAT_TITLE = `You are a title generator for a helpful assistant for Elastic Security. Assume the following human message is the start of a conversation between you and a human. Generate a relevant conversation title for the human's message in plain text. Make sure the title is formatted for the user, without using quotes or markdown. The title should clearly reflect the content of the message and be appropriate for a list of conversations. Respond only with the title. As an example, for the given MESSAGE, this is the TITLE: