Create Attack Discovery schedule

Server: https://{kibana_url}

POST /api/attack_discovery/schedules
POST /s/{space_id}/api/attack_discovery/schedules

Refer to Spaces for more information.

Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.

Request

Responses

The Attack Discovery schedule was successfully created.

application/json

Bad Request response.

application/json

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request POST 'http://localhost:5601/api/attack_discovery/schedules' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
   "name": "Daily Security Analysis",
   "enabled": true,
   "params": {
     "alerts_index_pattern": ".alerts-security.alerts-default",
     "api_config": {
       "actionTypeId": "bedrock",
       "connectorId": "my-bedrock-connector",
       "name": "Claude 3.5 Sonnet"
     },
     "size": 100,
     "start": "now-24h",
     "end": "now"
   },
   "schedule": {
     "interval": "24h"
   },
   "actions": [
      {
         "action_type_id": ".cases",
         "id": "system-connector-.cases",
         "params": {
           "subAction": "run",
           "subActionParams": {
             "timeWindow": "7d",
             "reopenClosedCases": false,
             "groupingBy": [],
             "templateId": null
           }
         },
         "uuid": "12345678-1234-1234-1234-123456789012"
       }
   ]
 }'

Request

Request example

{
  "actions": [],
  "enabled": true,
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  }
}

Response

{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  },
  "updated_at": "2023-10-31T10:00:00.000Z",
  "updated_by": "elastic"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}

Request { actions , enabled , name , params , schedule , }

Responses

Request