Find Attack Discovery schedules that match the search criteria
https://{kibana_url}
- GET /api/attack_discovery/schedules/_find
Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.
Query Parameters
-
pagenumber Page number to return (used for pagination). Defaults to 1.
-
per_pagenumber Number of Attack Discovery schedules to return per page (used for pagination). Defaults to 10.
-
sort_fieldstring · min: 1 Field used to sort results. Common fields include 'name', 'created_at', 'updated_at', and 'enabled'.
-
sort_direction Sort order direction. Use 'asc' for ascending or 'desc' for descending. Defaults to 'asc'.
-
Values:
ascdesc
Responses
Indicates a successful call.
-
dataobjectrequired -
Array of matched Attack Discovery schedule objects.
-
actions -
The Attack Discovery schedule actions
-
action_type_idstringrequired -
The action type used for sending notifications.
-
alerts_filterobject -
frequency -
The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
-
notify_when -
The condition for throttling the notification:
onActionGroupChange,onActiveAlert, oronThrottleInterval -
Values:
onActiveAlertonThrottleIntervalonActionGroupChange -
summarybooleanrequired -
Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
-
throttlestring · pattern: ^[1-9]\d*[smhd]$required -
Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
-
groupstringrequired -
Groups actions by use cases. Use
defaultfor alert notifications. -
idstringrequired -
The connector ID.
-
paramsobjectrequired -
Object containing the allowed connector fields, which varies according to the connector type.
-
uuidstring · min: 1 -
A string that does not contain only whitespace characters.
-
action_type_idstringrequired -
The action type used for sending notifications.
-
idstringrequired -
The connector ID.
-
paramsobjectrequired -
Object containing the allowed connector fields, which varies according to the connector type.
-
uuidstring · min: 1 -
A string that does not contain only whitespace characters.
-
created_atstringrequired -
The date the schedule was created
-
created_bystringrequired -
The name of the user that created the schedule
-
enabledbooleanrequired -
Indicates whether the schedule is enabled
-
idstringrequired -
UUID of Attack Discovery schedule
-
last_execution -
An Attack Discovery schedule execution information
-
namestringrequired -
The name of the schedule
-
params -
An Attack Discovery schedule params
-
alerts_index_patternstringrequired -
The index pattern to get alerts from
-
api_config -
LLM API configuration.
-
actionTypeIdstringrequired -
Action type ID
-
connectorIdstringrequired -
Connector ID
-
defaultSystemPromptIdstring -
Default system prompt ID
-
modelstring -
Model
-
namestringrequired -
The name of the connector
-
combined_filterobject -
endstring -
filtersobject -
The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
-
sizenumberrequired -
startstring -
updated_atstringrequired -
The date the schedule was updated
-
updated_bystringrequired -
The name of the user that updated the schedule
-
pagenumberrequired -
Current page number of the paginated result set.
-
per_pagenumberrequired -
Number of items requested per page.
-
totalnumberrequired -
Total number of Attack Discovery schedules matching the query (across all pages).
Bad Request response.
-
errorstring -
Error type
-
messagestring -
Human-readable error message
-
status_codenumber -
HTTP status code