stack kb security-detections-api search-attacks cli command

elastic stack kb security-detections-api search-attacks [options]
		

Find and/or aggregate attack discovery alerts

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--source string

Repeatable: pass --source multiple times to supply more than one value

--aggs string

--fields string[]

Repeatable: pass --fields multiple times to supply more than one value

--query string

--runtime-mappings string

--size number

--sort string

Repeatable: pass --sort multiple times to supply more than one value

--track-total-hits

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON