Get Attack Discovery schedule by ID

Server: https://{kibana_url}

GET /api/attack_discovery/schedules/{id}

Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.

Path Parameters

id string · min: 1 required: The unique identifier (UUID) of the Attack Discovery schedule to retrieve. This ID is returned when creating a schedule and can be found in schedule listings.

Responses

Successfully retrieved Attack Discovery schedule with complete configuration and metadata

application/json

Bad Request response.

application/json

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"

Response

{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "last_execution": {
    "date": "2023-10-31T10:00:00.000Z",
    "last_duration": 45.2,
    "status": "ok"
  },
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  },
  "updated_at": "2023-10-31T10:00:00.000Z",
  "updated_by": "elastic"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}