---
type: api
title: Get the latest Attack Discovery generations metadata for the current user
description: Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-getattackdiscoverygenerations
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-getattackdiscoverygenerations
products:
  - Kibana
---

# Get the latest Attack Discovery generations metadata for the current user

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/attack_discovery/generations`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.

## Query String Parameters

- `end` (string)
  End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
- `size` (number · min: 1 · default: 50)
  The maximum number of generations to retrieve
- `scheduled` (boolean)
  Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use `true` to return only scheduled generations or `false` to return only ad-hoc (interactive or action-triggered) generations.
- `start` (string)
  Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `generations` ([] object)
  List of Attack Discovery generations
  - `alerts_context_count` (number)
    The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
  - `connector_id` (string)
    The connector id (event.dataset) for this generation
  - `connector_stats` (object)
    Stats applicable to the connector for this generation
    - `average_successful_duration_nanoseconds` (number)
      The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
    - `successful_generations` (number)
      The number of successful generations for the same connector id, for the current user
  - `conversation_id` (string)
    Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
  - `discoveries` (number)
    The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
  - `duplicates_dropped_count` (integer)
    The number of attack discoveries dropped as duplicates during the persist step
  - `end` (string)
    When generation ended (max event.end)
  - `error_category` (string)
    Structured error category from server classification (optional; absent for successful generations)
  - `execution_uuid` (string)
    The unique identifier (kibana.alert.rule.execution.uuid) for the generation
  - `failed_workflow_id` (string)
    Workflow ID that caused the failure (optional; absent for successful generations)
  - `generated_count` (integer)
    The number of attack discoveries generated before deduplication and hallucination filtering
  - `hallucinations_filtered_count` (integer)
    The number of attack discoveries filtered as hallucinations during the validation step
  - `loading_message` (string)
    Generation loading message (kibana.alert.rule.execution.status)
  - `persisted_count` (integer)
    The number of attack discoveries successfully persisted after deduplication and hallucination filtering
  - `reason` (string)
    Reason for failed generations (event.reason)
  - `source_metadata` (object) — nullable
    Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
    - `action_execution_uuid` (string)
      The action execution UUID from the alerting framework
    - `rule_id` (string)
      The ID of the alerting rule that triggered this generation
    - `rule_name` (string)
      The name of the alerting rule that triggered this generation
  - `start` (string)
    When generation started (min event.start)
  - `status` (enum)
    The status of the attack discovery generation
    Values: `canceled`, `dismissed`, `failed`, `started`, `succeeded`
  - `step_event_actions` ([] string)
    Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.
  - `workflow_executions` ({})
    Workflow execution tracking for manual orchestration
    - `alertRetrieval` ([] object) — nullable
      Alert retrieval workflow executions (one per workflow invoked)
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `gate` ([] object) — nullable
      Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `generation` ({})
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `validation` ({})
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
  - `workflow_id` (string)
    The workflow definition ID for deep linking
  - `workflow_run_id` (string)
    The workflow execution ID for monitoring
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request GET 'http://localhost:5601/api/attack_discovery/generations?size=50&start=now-24h&end=now' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"
```

## Response Examples

#### Latest Attack Discovery generation metadata for the current user.

```json
{
  "generations": [
    {
      "alerts_context_count": 75,
      "connector_id": "chatGpt5_0ChatAzure",
      "discoveries": 3,
      "end": "2025-09-29T06:42:44.810Z",
      "execution_uuid": "46b218d5-535d-4329-be56-d0f6af6986b7",
      "loading_message": "AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.",
      "start": "2025-09-29T06:42:08.962Z",
      "status": "succeeded"
    }
  ]
}
```

#### Bad Request error returned when the size parameter is invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid size parameter. Must be a positive number.",
  "status_code": 400
}
```