Security Attack discovery
Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.
16 endpoints
-
Bulk update Attack discoveries
- POST /api/attack_discovery/_bulk
-
Find Attack discoveries that match the search criteria
- GET /api/attack_discovery/_find
-
Generate attack discoveries from alerts
- POST /api/attack_discovery/_generate
-
Get the latest Attack Discovery generations metadata for the current user
- GET /api/attack_discovery/generations
-
Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
- GET /api/attack_discovery/generations/{execution_uuid}
-
Dismiss an Attack Discovery generation
- POST /api/attack_discovery/generations/{execution_uuid}/_dismiss
-
Create Attack Discovery schedule
- POST /api/attack_discovery/schedules
-
Bulk delete Attack Discovery schedules
- POST /api/attack_discovery/schedules/_bulk_delete
-
Bulk disable Attack Discovery schedules
- POST /api/attack_discovery/schedules/_bulk_disable
-
Bulk enable Attack Discovery schedules
- POST /api/attack_discovery/schedules/_bulk_enable
-
Find Attack Discovery schedules that match the search criteria
- GET /api/attack_discovery/schedules/_find
-
Delete Attack Discovery schedule
- DELETE /api/attack_discovery/schedules/{id}
-
Get Attack Discovery schedule by ID
- GET /api/attack_discovery/schedules/{id}
-
Update Attack Discovery schedule
- PUT /api/attack_discovery/schedules/{id}
-
Disable Attack Discovery schedule
- POST /api/attack_discovery/schedules/{id}/_disable
-
Enable Attack Discovery schedule
- POST /api/attack_discovery/schedules/{id}/_enable