--- type: api title: Create Attack Discovery schedule description: Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found. url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-createattackdiscoveryschedules resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-createattackdiscoveryschedules products: - Kibana --- # Create Attack Discovery schedule - Server: `https://{kibana_url}` ## Paths - `POST` `/api/attack_discovery/schedules` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth) ## Description Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found. ## Request Body `application/json` Attack Discovery schedule configuration including name, parameters, schedule interval, and actions - `actions` ([] union) — optional The Attack Discovery schedule actions - **AttackDiscoveryApiScheduleGeneralAction** - `action_type_id` (string) — required The action type used for sending notifications. - `alerts_filter` (object) — optional - `frequency` ({}) — optional The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals). - `notify_when` (enum) — required The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval` Values: `onActiveAlert`, `onThrottleInterval`, `onActionGroupChange` - `summary` (boolean) — required Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert - `throttle` (string · pattern: ^[1-9]\d*[smhd]$) — required Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days. - `group` (string) — required Groups actions by use cases. Use `default` for alert notifications. - `id` (string) — required The connector ID. - `params` (object) — required Object containing the allowed connector fields, which varies according to the connector type. - `uuid` (string · min: 1) — optional A string that does not contain only whitespace characters. - **AttackDiscoveryApiScheduleSystemAction** - `action_type_id` (string) — required The action type used for sending notifications. - `id` (string) — required The connector ID. - `params` (object) — required Object containing the allowed connector fields, which varies according to the connector type. - `uuid` (string · min: 1) — optional A string that does not contain only whitespace characters. - `enabled` (boolean) — optional Indicates whether the schedule is enabled - `name` (string) — required The name of the schedule - `params` ({}) — required An Attack Discovery schedule params - `alerts_index_pattern` (string) — required The index pattern to get alerts from - `api_config` ({}) — required LLM API configuration. - `actionTypeId` (string) — required Action type ID - `connectorId` (string) — required Connector ID - `defaultSystemPromptId` (string) — optional Default system prompt ID - `model` (string) — optional Model - `provider` (enum) — optional Provider Values: `OpenAI`, `Azure OpenAI`, `Other` - `name` (string) — required The name of the connector - `combined_filter` (object) — optional - `end` (string) — optional - `filters` ([] object) — optional The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array. - `query` ({}) — optional An query condition to filter alerts - `language` (string) — required - `query` (string | object) — required - `size` (number) — required - `start` (string) — optional - `schedule` ({}) — required - `interval` (string) — required The schedule interval ## Responses #### `200` The Attack Discovery schedule was successfully created. `application/json` - `actions` ([] union) The Attack Discovery schedule actions Same options as `actions` - `created_at` (string) The date the schedule was created - `created_by` (string) The name of the user that created the schedule - `enabled` (boolean) Indicates whether the schedule is enabled - `id` (string) UUID of Attack Discovery schedule - `last_execution` ({}) An Attack Discovery schedule execution information - `date` (string) Date of the execution - `duration` (number) Duration of the execution - `message` (string) - `status` (enum) An Attack Discovery schedule execution status Values: `ok`, `active`, `error`, `unknown`, `warning` - `name` (string) The name of the schedule - `params` ({}) An Attack Discovery schedule params Same fields as `params` - `schedule` ({}) - `interval` (string) The schedule interval - `updated_at` (string) The date the schedule was updated - `updated_by` (string) The name of the user that updated the schedule #### `400` Bad Request response. `application/json` - `error` (string) Error type - `message` (string) Human-readable error message describing what went wrong - `status_code` (number) HTTP status code ## Code Examples #### curl ```curl curl \ --request POST 'http://localhost:5601/api/attack_discovery/schedules' \ --header "Authorization: $API_KEY" \ --header "Content-Type: application/json" \ --data '{ "name": "Daily Security Analysis", "enabled": true, "params": { "alerts_index_pattern": ".alerts-security.alerts-default", "api_config": { "actionTypeId": "bedrock", "connectorId": "my-bedrock-connector", "name": "Claude 3.5 Sonnet" }, "size": 100, "start": "now-24h", "end": "now" }, "schedule": { "interval": "24h" }, "actions": [ { "action_type_id": ".cases", "id": "system-connector-.cases", "params": { "subAction": "run", "subActionParams": { "timeWindow": "7d", "reopenClosedCases": false, "groupingBy": [], "templateId": null } }, "uuid": "12345678-1234-1234-1234-123456789012" } ] }' ``` ## Request Examples #### Create a daily Attack Discovery schedule that runs every 24 hours. ```json { "actions": [], "enabled": true, "name": "Daily Security Analysis", "params": { "alerts_index_pattern": ".alerts-security.alerts-default", "api_config": { "actionTypeId": "bedrock", "connectorId": "my-bedrock-connector", "name": "Claude 3.5 Sonnet" }, "end": "now", "size": 100, "start": "now-24h" }, "schedule": { "interval": "24h" } } ``` ## Response Examples #### A newly created Attack Discovery schedule. ```json { "actions": [], "created_at": "2023-10-31T10:00:00.000Z", "created_by": "elastic", "enabled": true, "id": "12345678-1234-1234-1234-123456789012", "name": "Daily Security Analysis", "params": { "alerts_index_pattern": ".alerts-security.alerts-default", "api_config": { "actionTypeId": "bedrock", "connectorId": "my-bedrock-connector", "name": "Claude 3.5 Sonnet" }, "end": "now", "size": 100, "start": "now-24h" }, "schedule": { "interval": "24h" }, "updated_at": "2023-10-31T10:00:00.000Z", "updated_by": "elastic" } ``` #### Bad Request error returned when the create schedule payload is invalid. ```json { "error": "Bad Request", "message": "Invalid request parameters.", "status_code": 400 } ```