---
type: api
title: Find Attack Discovery schedules that match the search criteria
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-findattackdiscoveryschedules
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-findattackdiscoveryschedules
products:
  - Kibana
---

# Find Attack Discovery schedules that match the search criteria

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/attack_discovery/schedules/_find`
- `GET` `/s/{space_id}/api/attack_discovery/schedules/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.

## Query String Parameters

- `page` (number)
  Page number to return (used for pagination). Defaults to 1.
- `per_page` (number)
  Number of Attack Discovery schedules to return per page (used for pagination). Defaults to 10.
- `sort_field` (string · min: 1)
  Field used to sort results. Common fields include 'name', 'created_at', 'updated_at', and 'enabled'.
- `sort_direction` (enum)
  Sort order direction. Use 'asc' for ascending or 'desc' for descending. Defaults to 'asc'.
  Values: `asc`, `desc`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` ([] object)
  Array of matched Attack Discovery schedule objects.
  - `actions` ([] union)
    The Attack Discovery schedule actions
    - **AttackDiscoveryApiScheduleGeneralAction**
      - `action_type_id` (string)
        The action type used for sending notifications.
      - `alerts_filter` (object)
      - `frequency` ({})
        The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
        - `notify_when` (enum)
          The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`,  or `onThrottleInterval`
          Values: `onActiveAlert`, `onThrottleInterval`, `onActionGroupChange`
        - `summary` (boolean)
          Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
        - `throttle` (string · pattern: ^[1-9]\d*[smhd]$)
          Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
      - `group` (string)
        Groups actions by use cases. Use `default` for alert notifications.
      - `id` (string)
        The connector ID.
      - `params` (object)
        Object containing the allowed connector fields, which varies according to the connector type.
      - `uuid` (string · min: 1)
        A string that does not contain only whitespace characters.
    - **AttackDiscoveryApiScheduleSystemAction**
      - `action_type_id` (string)
        The action type used for sending notifications.
      - `id` (string)
        The connector ID.
      - `params` (object)
        Object containing the allowed connector fields, which varies according to the connector type.
      - `uuid` (string · min: 1)
        A string that does not contain only whitespace characters.
  - `created_at` (string)
    The date the schedule was created
  - `created_by` (string)
    The name of the user that created the schedule
  - `enabled` (boolean)
    Indicates whether the schedule is enabled
  - `id` (string)
    UUID of Attack Discovery schedule
  - `last_execution` ({})
    An Attack Discovery schedule execution information
    - `date` (string)
      Date of the execution
    - `duration` (number)
      Duration of the execution
    - `message` (string)
    - `status` (enum)
      An Attack Discovery schedule execution status
      Values: `ok`, `active`, `error`, `unknown`, `warning`
  - `name` (string)
    The name of the schedule
  - `params` ({})
    An Attack Discovery schedule params
    - `alerts_index_pattern` (string)
      The index pattern to get alerts from
    - `api_config` ({})
      LLM API configuration.
      - `actionTypeId` (string)
        Action type ID
      - `connectorId` (string)
        Connector ID
      - `defaultSystemPromptId` (string)
        Default system prompt ID
      - `model` (string)
        Model
      - `provider` (enum)
        Provider
        Values: `OpenAI`, `Azure OpenAI`, `Other`
      - `name` (string)
        The name of the connector
    - `combined_filter` (object)
    - `end` (string)
    - `filters` ([] object)
      The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
    - `query` ({})
      An query condition to filter alerts
      - `language` (string)
      - `query` (string | object)
    - `size` (number)
    - `start` (string)
  - `schedule` ({})
    - `interval` (string)
      The schedule interval
  - `updated_at` (string)
    The date the schedule was updated
  - `updated_by` (string)
    The name of the user that updated the schedule
- `page` (number)
  Current page number of the paginated result set.
- `per_page` (number)
  Number of items requested per page.
- `total` (number)
  Total number of Attack Discovery schedules matching the query (across all pages).
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request GET 'http://localhost:5601/api/attack_discovery/schedules/_find' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"
```

## Response Examples

#### Paginated list of Attack Discovery schedules matching the search criteria.

```json
{
  "data": [
    {
      "actions": [],
      "created_at": "2023-10-31T10:00:00.000Z",
      "created_by": "elastic",
      "enabled": true,
      "id": "12345678-1234-1234-1234-123456789012",
      "name": "Daily Security Analysis",
      "params": {
        "alerts_index_pattern": ".alerts-security.alerts-default",
        "api_config": {
          "actionTypeId": "bedrock",
          "connectorId": "my-bedrock-connector",
          "name": "Claude 3.5 Sonnet"
        },
        "end": "now",
        "size": 100,
        "start": "now-24h"
      },
      "schedule": {
        "interval": "24h"
      },
      "updated_at": "2023-10-31T10:00:00.000Z",
      "updated_by": "elastic"
    }
  ],
  "page": 1,
  "per_page": 10,
  "total": 1
}
```

#### Bad Request error returned when find-schedules query parameters are invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid request payload.",
  "status_code": 400
}
```