---
type: api
title: Get Attack Discovery schedule by ID
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-getattackdiscoveryschedules
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-getattackdiscoveryschedules
products:
  - Kibana
---

# Get Attack Discovery schedule by ID

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/attack_discovery/schedules/{id}`
- `GET` `/s/{space_id}/api/attack_discovery/schedules/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

#### Path Parameters

- `id` (string · min: 1)
  The unique identifier (UUID) of the Attack Discovery schedule to retrieve. This ID is returned when creating a schedule and can be found in schedule listings.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.

## Responses

#### `200`

Successfully retrieved Attack Discovery schedule with complete configuration and metadata

`application/json`

- `actions` ([] union)
  The Attack Discovery schedule actions
  - **AttackDiscoveryApiScheduleGeneralAction**
    - `action_type_id` (string)
      The action type used for sending notifications.
    - `alerts_filter` (object)
    - `frequency` ({})
      The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
      - `notify_when` (enum)
        The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`,  or `onThrottleInterval`
        Values: `onActiveAlert`, `onThrottleInterval`, `onActionGroupChange`
      - `summary` (boolean)
        Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
      - `throttle` (string · pattern: ^[1-9]\d*[smhd]$)
        Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
    - `group` (string)
      Groups actions by use cases. Use `default` for alert notifications.
    - `id` (string)
      The connector ID.
    - `params` (object)
      Object containing the allowed connector fields, which varies according to the connector type.
    - `uuid` (string · min: 1)
      A string that does not contain only whitespace characters.
  - **AttackDiscoveryApiScheduleSystemAction**
    - `action_type_id` (string)
      The action type used for sending notifications.
    - `id` (string)
      The connector ID.
    - `params` (object)
      Object containing the allowed connector fields, which varies according to the connector type.
    - `uuid` (string · min: 1)
      A string that does not contain only whitespace characters.
- `created_at` (string)
  The date the schedule was created
- `created_by` (string)
  The name of the user that created the schedule
- `enabled` (boolean)
  Indicates whether the schedule is enabled
- `id` (string)
  UUID of Attack Discovery schedule
- `last_execution` ({})
  An Attack Discovery schedule execution information
  - `date` (string)
    Date of the execution
  - `duration` (number)
    Duration of the execution
  - `message` (string)
  - `status` (enum)
    An Attack Discovery schedule execution status
    Values: `ok`, `active`, `error`, `unknown`, `warning`
- `name` (string)
  The name of the schedule
- `params` ({})
  An Attack Discovery schedule params
  - `alerts_index_pattern` (string)
    The index pattern to get alerts from
  - `api_config` ({})
    LLM API configuration.
    - `actionTypeId` (string)
      Action type ID
    - `connectorId` (string)
      Connector ID
    - `defaultSystemPromptId` (string)
      Default system prompt ID
    - `model` (string)
      Model
    - `provider` (enum)
      Provider
      Values: `OpenAI`, `Azure OpenAI`, `Other`
    - `name` (string)
      The name of the connector
  - `combined_filter` (object)
  - `end` (string)
  - `filters` ([] object)
    The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
  - `query` ({})
    An query condition to filter alerts
    - `language` (string)
    - `query` (string | object)
  - `size` (number)
  - `start` (string)
- `schedule` ({})
  - `interval` (string)
    The schedule interval
- `updated_at` (string)
  The date the schedule was updated
- `updated_by` (string)
  The name of the user that updated the schedule
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message describing what went wrong
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"
```

## Response Examples

#### An Attack Discovery schedule retrieved by ID, including last execution metadata.

```json
{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "last_execution": {
    "date": "2023-10-31T10:00:00.000Z",
    "last_duration": 45.2,
    "status": "ok"
  },
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  },
  "updated_at": "2023-10-31T10:00:00.000Z",
  "updated_by": "elastic"
}
```

#### Bad Request error returned when the get-schedule request is invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}
```