---
type: api
title: Get the latest Attack Discovery generations metadata for the current user
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-getattackdiscoverygenerations
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-getattackdiscoverygenerations
products:
  - Kibana
---

# Get the latest Attack Discovery generations metadata for the current user

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/attack_discovery/generations`
- `GET` `/s/{space_id}/api/attack_discovery/generations`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.

## Query String Parameters

- `end` (string)
  End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
- `size` (number · min: 1 · default: 50)
  The maximum number of generations to retrieve
- `scheduled` (boolean)
  Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use `true` to return only scheduled generations or `false` to return only ad-hoc (interactive or action-triggered) generations.
- `start` (string)
  Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `generations` ([] object)
  List of Attack Discovery generations
  - `alerts_context_count` (number)
    The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
  - `connector_id` (string)
    The connector id (event.dataset) for this generation
  - `connector_stats` (object)
    Stats applicable to the connector for this generation
    - `average_successful_duration_nanoseconds` (number)
      The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
    - `successful_generations` (number)
      The number of successful generations for the same connector id, for the current user
  - `conversation_id` (string)
    Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
  - `discoveries` (number)
    The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
  - `duplicates_dropped_count` (integer)
    The number of attack discoveries dropped as duplicates during the persist step
  - `end` (string)
    When generation ended (max event.end)
  - `error_category` (string)
    Structured error category from server classification (optional; absent for successful generations)
  - `execution_uuid` (string)
    The unique identifier (kibana.alert.rule.execution.uuid) for the generation
  - `failed_workflow_id` (string)
    Workflow ID that caused the failure (optional; absent for successful generations)
  - `generated_count` (integer)
    The number of attack discoveries generated before deduplication and hallucination filtering
  - `hallucinations_filtered_count` (integer)
    The number of attack discoveries filtered as hallucinations during the validation step
  - `loading_message` (string)
    Generation loading message (kibana.alert.rule.execution.status)
  - `persisted_count` (integer)
    The number of attack discoveries successfully persisted after deduplication and hallucination filtering
  - `reason` (string)
    Reason for failed generations (event.reason)
  - `source_metadata` (object) — nullable
    Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
    - `action_execution_uuid` (string)
      The action execution UUID from the alerting framework
    - `rule_id` (string)
      The ID of the alerting rule that triggered this generation
    - `rule_name` (string)
      The name of the alerting rule that triggered this generation
  - `start` (string)
    When generation started (min event.start)
  - `status` (enum)
    The status of the attack discovery generation
    Values: `canceled`, `dismissed`, `failed`, `started`, `succeeded`
  - `step_event_actions` ([] string)
    Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.
  - `workflow_executions` ({})
    Workflow execution tracking for manual orchestration
    - `alertRetrieval` ([] object) — nullable
      Alert retrieval workflow executions (one per workflow invoked)
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `gate` ([] object) — nullable
      Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `generation` ({})
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `validation` ({})
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
  - `workflow_id` (string)
    The workflow definition ID for deep linking
  - `workflow_run_id` (string)
    The workflow execution ID for monitoring
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request GET 'http://localhost:5601/api/attack_discovery/generations?size=50&start=now-24h&end=now' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"
```

## Response Examples

#### Latest Attack Discovery generation metadata for the current user.

```json
{
  "generations": [
    {
      "alerts_context_count": 75,
      "connector_id": "chatGpt5_0ChatAzure",
      "discoveries": 3,
      "end": "2025-09-29T06:42:44.810Z",
      "execution_uuid": "46b218d5-535d-4329-be56-d0f6af6986b7",
      "loading_message": "AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.",
      "start": "2025-09-29T06:42:08.962Z",
      "status": "succeeded"
    }
  ]
}
```

#### Bad Request error returned when the size parameter is invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid size parameter. Must be a positive number.",
  "status_code": 400
}
```