---
type: api
title: Find Attack discoveries that match the search criteria
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-attackdiscoveryfind
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-attackdiscoveryfind
products:
  - Kibana
---

# Find Attack discoveries that match the search criteria

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/attack_discovery/_find`
- `GET` `/s/{space_id}/api/attack_discovery/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.

## Query String Parameters

- `alert_ids` ([] string)
  Filter results to Attack discoveries that include any of the provided alert IDs
- `connector_names` ([] string)
  Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from `connector_id` values used to generate Attack discoveries.
- `enable_field_rendering` (boolean · default: false)
  Enables a markdown syntax used to render pivot fields, for example ``{{ user.name james }}``. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
- `end` (string)
  End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
- `ids` ([] string)
  Filter results to the Attack discoveries with the specified IDs
- `include_unique_alert_ids` (boolean)
  If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries
- `page` (integer · min: 1 · default: 1)
  Page number to return (used for pagination). Defaults to 1.
- `per_page` (integer · min: 1 · default: 10)
  Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
- `search` (string)
  Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
- `shared` (boolean)
  Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user. Mutually exclusive with `include_all_authors`.
- `include_all_authors` (boolean)
  If `true`, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with `shared`.
- `scheduled` (boolean)
  Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.
- `sort_field` (enum)
  Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.
  Values: `@timestamp`
- `sort_order` (enum)
  Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.
  Values: `asc`, `desc`
- `start` (string)
  Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
- `status` ([] enum)
  Filter by alert workflow status. Provide one or more of the allowed workflow states.
  Values: `acknowledged`, `closed`, `open`
- `with_replacements` (boolean · default: true)
  When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `connector_names` ([] string)
  List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
- `data` ([] object)
  Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema.
  - `alert_ids` ([] string)
    The alert IDs that the attack discovery is based on
  - `alert_rule_uuid` (string)
    The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
  - `alert_start` (string)
    The optional time the attack discovery alert was created
  - `alert_updated_at` (string)
    The optional time the attack discovery alert was last updated
  - `alert_updated_by_user_id` (string)
    The optional id of the user who last updated the attack discovery alert
  - `alert_updated_by_user_name` (string)
    The optional username of the user who updated the attack discovery alert
  - `alert_workflow_reason` (string)
    The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed
  - `alert_workflow_status` (string)
    The optional kibana.alert.workflow_status of this attack discovery
  - `alert_workflow_status_updated_at` (string)
    The optional time the attack discovery alert workflow status was last updated
  - `assignees` ([] string)
    The optional array of user-IDs who have been assigned the attack
  - `connector_id` (string)
    The ID of the connector that generated the attack discovery
  - `connector_name` (string)
    The (human readable) name of the connector that generated the attack discovery
  - `details_markdown` (string)
    Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
  - `entity_summary_markdown` (string)
    An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
  - `generation_uuid` (string)
    The generation ID of the run that created the attack discovery
  - `id` (string)
    The unique ID of the attack discovery
  - `index` (string)
    The concrete Elasticsearch index where this attack discovery is stored
  - `mitre_attack_tactics` ([] string)
    An optional array of MITRE ATT&CK tactic for the attack discovery
  - `replacements` (object)
    Replacements object used to anonymize/deanonymize messages
  - `risk_score` (integer)
    The optional, (but typically populated after generation) risk score of the alert
  - `summary_markdown` (string)
    A markdown summary of attack discovery, using the same syntax
  - `tags` ([] string)
    The optional array of tags assigned the attack
  - `timestamp` (string · min: 1)
    A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
  - `title` (string)
    A title for the attack discovery, in plain text
  - `user_id` (string)
    The optional id of the user who generated the attack discovery
  - `user_name` (string)
    The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
  - `users` ([] object)
    The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.
    - `id` (string)
      User id.
    - `name` (string)
      User name.
- `page` (integer)
  Current page number of the paginated result set.
- `per_page` (integer)
  Number of items requested per page.
- `total` (integer)
  Total number of Attack discoveries matching the query (across all pages).
- `unique_alert_ids` ([] string)
  List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
- `unique_alert_ids_count` (integer)
  Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request GET 'http://localhost:5601/api/attack_discovery/_find?end=now&include_unique_alert_ids=false&page=1&per_page=10&search=&sort_field=%40timestamp&sort_order=desc&start=now-24h&status=open&status=acknowledged' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"
```

## Response Examples

#### Paginated list of Attack discoveries matching the search criteria.

```json
{
  "connector_names": [
    "GPT-5 Chat"
  ],
  "data": [
    {
      "connector_name": "GPT-5 Chat",
      "id": "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "title": "Suspicious process execution on host-01"
    }
  ],
  "page": 1,
  "per_page": 10,
  "total": 1,
  "unique_alert_ids_count": 0
}
```

#### Bad Request error returned when find query parameters are invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid request payload.",
  "status_code": 400
}
```