---
title: stack kb security-attack-discovery-api post-attack-discovery-generate cli command
description: Generate attack discoveries from alerts Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4120/reference/elastic-cli/cli/stack/kb/security-attack-discovery-api/post-attack-discovery-generate
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-attack-discovery-api post-attack-discovery-generate cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-attack-discovery-api post-attack-discovery-generate \
  --alerts-index-pattern <alerts-index-pattern> \
  --anonymization-fields <anonymization-fields> \
  --api-config <api-config> \
  --size <size> \
  --sub-action <sub-action> \
  [options]
```

Generate attack discoveries from alerts
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--alerts-index-pattern string required">
    The (space specific) index pattern that contains the alerts to use as
    context for the attack discovery.
    Example: .alerts-security.alerts-default
  </definition>
  <definition term="--anonymization-fields string[] required">
    The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the `/api/security_ai_assistant/anonymization_fields/_find` API (for a specific Kibana space) to provide this value.
    **Repeatable:** pass `--anonymization-fields` multiple times to supply more than one value
  </definition>
  <definition term="--api-config string required">
    LLM API configuration.
  </definition>
  <definition term="--size number required">
  </definition>
  <definition term="--sub-action enum required">
    **Values:** invokeAI, invokeStream
  </definition>
  <definition term="--connector-name string">
  </definition>
  <definition term="--end string">
  </definition>
  <definition term="--filter string">
    An Elasticsearch-style query DSL object used to filter alerts. For example:
    <```json { "filter": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "term": { "user.name": { "value": "james" } } } ], "minimum_should_match": 1 } } ], "should": [], "must_not": [] } }>
      } ```
    </```json { "filter": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "term": { "user.name": { "value": "james" } } } ], "minimum_should_match": 1 } } ], "should": [], "must_not": [] } }>
  </definition>
  <definition term="--model string">
  </definition>
  <definition term="--replacements string">
  </definition>
  <definition term="--start string">
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>