---
type: api
title: Security Attack discovery
description: Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/group/endpoint-security-attack-discovery-api
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/group/endpoint-security-attack-discovery-api
products:
  - Kibana
---

# Security Attack discovery

`Security Attack discovery API`

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.

- [Bulk update Attack discoveries](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-postattackdiscoverybulk): `POST` `/api/attack_discovery/_bulk`, `POST` `/s/{space_id}/api/attack_discovery/_bulk`
- [Find Attack discoveries that match the search criteria](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-attackdiscoveryfind): `GET` `/api/attack_discovery/_find`, `GET` `/s/{space_id}/api/attack_discovery/_find`
- [Generate attack discoveries from alerts](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-postattackdiscoverygenerate): `POST` `/api/attack_discovery/_generate`, `POST` `/s/{space_id}/api/attack_discovery/_generate`
- [Get the latest Attack Discovery generations metadata for the current user](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-getattackdiscoverygenerations): `GET` `/api/attack_discovery/generations`, `GET` `/s/{space_id}/api/attack_discovery/generations`
- [Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-getattackdiscoverygeneration): `GET` `/api/attack_discovery/generations/{execution_uuid}`, `GET` `/s/{space_id}/api/attack_discovery/generations/{execution_uuid}`
- [Dismiss an Attack Discovery generation](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-postattackdiscoverygenerationsdismiss): `POST` `/api/attack_discovery/generations/{execution_uuid}/_dismiss`, `POST` `/s/{space_id}/api/attack_discovery/generations/{execution_uuid}/_dismiss`
- [Create Attack Discovery schedule](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-createattackdiscoveryschedules): `POST` `/api/attack_discovery/schedules`, `POST` `/s/{space_id}/api/attack_discovery/schedules`
- [Bulk delete Attack Discovery schedules](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-bulkdeleteattackdiscoveryschedules): `POST` `/api/attack_discovery/schedules/_bulk_delete`, `POST` `/s/{space_id}/api/attack_discovery/schedules/_bulk_delete`
- [Bulk disable Attack Discovery schedules](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-bulkdisableattackdiscoveryschedules): `POST` `/api/attack_discovery/schedules/_bulk_disable`, `POST` `/s/{space_id}/api/attack_discovery/schedules/_bulk_disable`
- [Bulk enable Attack Discovery schedules](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-bulkenableattackdiscoveryschedules): `POST` `/api/attack_discovery/schedules/_bulk_enable`, `POST` `/s/{space_id}/api/attack_discovery/schedules/_bulk_enable`
- [Find Attack Discovery schedules that match the search criteria](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-findattackdiscoveryschedules): `GET` `/api/attack_discovery/schedules/_find`, `GET` `/s/{space_id}/api/attack_discovery/schedules/_find`
- [Delete Attack Discovery schedule](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-deleteattackdiscoveryschedules): `DELETE` `/api/attack_discovery/schedules/{id}`, `DELETE` `/s/{space_id}/api/attack_discovery/schedules/{id}`
- [Get Attack Discovery schedule by ID](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-getattackdiscoveryschedules): `GET` `/api/attack_discovery/schedules/{id}`, `GET` `/s/{space_id}/api/attack_discovery/schedules/{id}`
- [Update Attack Discovery schedule](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-updateattackdiscoveryschedules): `PUT` `/api/attack_discovery/schedules/{id}`, `PUT` `/s/{space_id}/api/attack_discovery/schedules/{id}`
- [Disable Attack Discovery schedule](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-disableattackdiscoveryschedules): `POST` `/api/attack_discovery/schedules/{id}/_disable`, `POST` `/s/{space_id}/api/attack_discovery/schedules/{id}/_disable`
- [Enable Attack Discovery schedule](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-enableattackdiscoveryschedules): `POST` `/api/attack_discovery/schedules/{id}/_enable`, `POST` `/s/{space_id}/api/attack_discovery/schedules/{id}/_enable`