Create Attack Discovery schedule
https://{kibana_url}
- POST /api/attack_discovery/schedules
Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.
Request
Attack Discovery schedule configuration including name, parameters, schedule interval, and actions
-
actions -
The Attack Discovery schedule actions
-
action_type_idstringrequired -
The action type used for sending notifications.
-
alerts_filterobject -
frequency -
The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
-
notify_when -
The condition for throttling the notification:
onActionGroupChange,onActiveAlert, oronThrottleInterval -
Values:
onActiveAlertonThrottleIntervalonActionGroupChange -
summarybooleanrequired -
Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
-
throttlestring · pattern: ^[1-9]\d*[smhd]$required -
Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
-
groupstringrequired -
Groups actions by use cases. Use
defaultfor alert notifications. -
idstringrequired -
The connector ID.
-
paramsobjectrequired -
Object containing the allowed connector fields, which varies according to the connector type.
-
uuidstring · min: 1 -
A string that does not contain only whitespace characters.
-
action_type_idstringrequired -
The action type used for sending notifications.
-
idstringrequired -
The connector ID.
-
paramsobjectrequired -
Object containing the allowed connector fields, which varies according to the connector type.
-
uuidstring · min: 1 -
A string that does not contain only whitespace characters.
-
enabledboolean -
Indicates whether the schedule is enabled
-
namestringrequired -
The name of the schedule
-
params -
An Attack Discovery schedule params
-
alerts_index_patternstringrequired -
The index pattern to get alerts from
-
api_config -
LLM API configuration.
-
actionTypeIdstringrequired -
Action type ID
-
connectorIdstringrequired -
Connector ID
-
defaultSystemPromptIdstring -
Default system prompt ID
-
modelstring -
Model
-
namestringrequired -
The name of the connector
-
combined_filterobject -
endstring -
filtersobject -
The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
-
sizenumberrequired -
startstring
Responses
The Attack Discovery schedule was successfully created.
-
actions -
The Attack Discovery schedule actions
-
created_atstringrequired -
The date the schedule was created
-
created_bystringrequired -
The name of the user that created the schedule
-
enabledbooleanrequired -
Indicates whether the schedule is enabled
-
idstringrequired -
UUID of Attack Discovery schedule
-
last_execution -
An Attack Discovery schedule execution information
-
namestringrequired -
The name of the schedule
-
params -
An Attack Discovery schedule params
-
updated_atstringrequired -
The date the schedule was updated
-
updated_bystringrequired -
The name of the user that updated the schedule
Bad Request response.
-
errorstring -
Error type
-
messagestring -
Human-readable error message describing what went wrong
-
status_codenumber -
HTTP status code