---
title: stack kb security-attack-discovery-api attack-discovery-find cli command
description: Find Attack discoveries that match the search criteria Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4075/reference/elastic-cli/cli/stack/kb/security-attack-discovery-api/attack-discovery-find
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-attack-discovery-api attack-discovery-find cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-attack-discovery-api attack-discovery-find [options]
```

Find Attack discoveries that match the search criteria
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--alert-ids string[]">
    Filter results to Attack discoveries that include any of the provided alert IDs
    **Repeatable:** pass `--alert-ids` multiple times to supply more than one value
  </definition>
  <definition term="--connector-names string[]">
    Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from `connector_id` values used to generate Attack discoveries.
    **Repeatable:** pass `--connector-names` multiple times to supply more than one value
  </definition>
  <definition term="--enable-field-rendering">
    Enables a markdown syntax used to render pivot fields, for example `\{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
  </definition>
  <definition term="--end string">
    End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
  </definition>
  <definition term="--ids string[]">
    Filter results to the Attack discoveries with the specified IDs
    **Repeatable:** pass `--ids` multiple times to supply more than one value
  </definition>
  <definition term="--include-unique-alert-ids">
    If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries
  </definition>
  <definition term="--page number">
    Page number to return (used for pagination). Defaults to 1.
  </definition>
  <definition term="--per-page number">
    Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
  </definition>
  <definition term="--search string">
    Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
  </definition>
  <definition term="--shared">
    Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user. Mutually exclusive with `include_all_authors`.
  </definition>
  <definition term="--include-all-authors">
    If `true`, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with `shared`.
  </definition>
  <definition term="--scheduled">
    Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.
  </definition>
  <definition term="--sort-field enum">
    Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.
    **Values:** @timestamp
  </definition>
  <definition term="--sort-order enum">
    Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.
    **Values:** asc, desc
  </definition>
  <definition term="--start string">
    Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
  </definition>
  <definition term="--status string[]">
    Filter by alert workflow status. Provide one or more of the allowed workflow states.
    **Repeatable:** pass `--status` multiple times to supply more than one value
  </definition>
  <definition term="--with-replacements">
    When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>