Get the latest Attack Discovery generations metadata for the current user
https://{kibana_url}
- GET /api/attack_discovery/generations
- GET /s/{space_id}/api/attack_discovery/generations
Refer to Spaces for more information.
Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.
Query Parameters
-
endstring End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
-
sizenumber · min: 1 · default: 50 The maximum number of generations to retrieve
-
scheduledboolean Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use
trueto return only scheduled generations orfalseto return only ad-hoc (interactive or action-triggered) generations.-
startstring Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
Responses
Indicates a successful call.
-
generationsobjectrequired -
List of Attack Discovery generations
-
alerts_context_countnumber -
The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
-
connector_idstringrequired -
The connector id (event.dataset) for this generation
-
connector_statsobject -
Stats applicable to the connector for this generation
-
average_successful_duration_nanosecondsnumber -
The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
-
successful_generationsnumber -
The number of successful generations for the same connector id, for the current user
-
conversation_idstring -
Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
-
discoveriesnumberrequired -
The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
-
duplicates_dropped_countinteger -
The number of attack discoveries dropped as duplicates during the persist step
-
endstring -
When generation ended (max event.end)
-
error_categorystring -
Structured error category from server classification (optional; absent for successful generations)
-
execution_uuidstringrequired -
The unique identifier (kibana.alert.rule.execution.uuid) for the generation
-
failed_workflow_idstring -
Workflow ID that caused the failure (optional; absent for successful generations)
-
generated_countinteger -
The number of attack discoveries generated before deduplication and hallucination filtering
-
hallucinations_filtered_countinteger -
The number of attack discoveries filtered as hallucinations during the validation step
-
loading_messagestring -
Generation loading message (kibana.alert.rule.execution.status)
-
persisted_countinteger -
The number of attack discoveries successfully persisted after deduplication and hallucination filtering
-
reasonstring -
Reason for failed generations (event.reason)
-
source_metadataobjectnullable -
Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
-
action_execution_uuidstring -
The action execution UUID from the alerting framework
-
rule_idstring -
The ID of the alerting rule that triggered this generation
-
rule_namestring -
The name of the alerting rule that triggered this generation
-
startstringrequired -
When generation started (min event.start)
-
status -
The status of the attack discovery generation
-
Values:
canceleddismissedfailedstartedsucceeded -
step_event_actionsstring -
Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.
-
workflow_executions -
Workflow execution tracking for manual orchestration
-
alertRetrievalobjectnullable -
Alert retrieval workflow executions (one per workflow invoked)
-
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
gateobjectnullable -
Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers
-
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
generation -
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
validation -
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
workflow_idstring -
The workflow definition ID for deep linking
-
workflow_run_idstring -
The workflow execution ID for monitoring
Bad Request response.
-
errorstring -
Error type
-
messagestring -
Human-readable error message
-
status_codenumber -
HTTP status code