---
title: Attack Discovery
description: Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential...
url: https://www.elastic.co/elastic/docs-builder/docs/3717/solutions/security/ai/attack-discovery
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Attack Discovery
Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This can help make the most of each security analyst’s time, fight alert fatigue, and reduce your mean time to respond.
You can generate discoveries in two ways:
- **Manual runs**: run the analysis on demand, whenever you need it.
- **Scheduled runs**: define a recurring schedule so discoveries are generated automatically, without needing manual runs.

Both methods run the same underlying analysis pipeline, so the discoveries you get are consistent no matter which one you use.
For a demo, refer to the following video (click to view).
[![Attack Discovery video](https://play.vidyard.com/eT92arEbpRddmSM4JeyzdX.jpg)](https://videos.elastic.co/watch/eT92arEbpRddmSM4JeyzdX?)

## What information does each discovery include?

Each discovery includes the following information describing the potential threat, generated by the connected LLM:
1. A descriptive title and a summary of the potential threat.
2. The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to.
3. The implicated entities (users and hosts), and what suspicious activity was observed for each.

![Attack Discovery detail view](https://www.elastic.co/elastic/docs-builder/docs/3717/solutions/images/security-attck-disc-example-disc.png)