Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
https://{kibana_url}
- GET /api/attack_discovery/generations/{execution_uuid}
- GET /s/{space_id}/api/attack_discovery/generations/{execution_uuid}
Refer to Spaces for more information.
Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.
Path Parameters
-
execution_uuidstring · min: 1required -
The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.
Query Parameters
-
enable_field_renderingboolean · default: false Enables a markdown syntax used to render pivot fields, for example
{{ user.name james }}. When disabled, the same example would be rendered asjames. This is primarily used for Attack Discovery views within Kibana. Defaults tofalse.-
with_replacementsboolean · default: true When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to
true.
Responses
Indicates a successful call.
-
dataobjectrequired -
Array of Attack discoveries generated during this execution.
-
alert_idsstringrequired -
The alert IDs that the attack discovery is based on
-
alert_rule_uuidstring -
The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
-
alert_startstring -
The optional time the attack discovery alert was created
-
alert_updated_atstring -
The optional time the attack discovery alert was last updated
-
alert_updated_by_user_idstring -
The optional id of the user who last updated the attack discovery alert
-
alert_updated_by_user_namestring -
The optional username of the user who updated the attack discovery alert
-
alert_workflow_statusstring -
The optional kibana.alert.workflow_status of this attack discovery
-
alert_workflow_status_updated_atstring -
The optional time the attack discovery alert workflow status was last updated
-
assigneesstring -
The optional array of user-IDs who have been assigned the attack
-
connector_idstringrequired -
The ID of the connector that generated the attack discovery
-
connector_namestringrequired -
The (human readable) name of the connector that generated the attack discovery
-
details_markdownstringrequired -
Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
-
entity_summary_markdownstring -
An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
-
generation_uuidstringrequired -
The generation ID of the run that created the attack discovery
-
idstringrequired -
The unique ID of the attack discovery
-
indexstring -
The concrete Elasticsearch index where this attack discovery is stored
-
mitre_attack_tacticsstring -
An optional array of MITRE ATT&CK tactic for the attack discovery
-
replacementsobject -
Replacements object used to anonymize/deanonymize messages
-
risk_scoreinteger -
The optional, (but typically populated after generation) risk score of the alert
-
summary_markdownstringrequired -
A markdown summary of attack discovery, using the same syntax
-
The optional array of tags assigned the attack
-
timestampstring · min: 1required -
A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
-
titlestringrequired -
A title for the attack discovery, in plain text
-
user_idstring -
The optional id of the user who generated the attack discovery
-
user_namestring -
The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
-
generation -
alerts_context_countnumber -
The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
-
connector_idstringrequired -
The connector id (event.dataset) for this generation
-
connector_statsobject -
Stats applicable to the connector for this generation
-
average_successful_duration_nanosecondsnumber -
The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
-
successful_generationsnumber -
The number of successful generations for the same connector id, for the current user
-
conversation_idstring -
Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
-
discoveriesnumberrequired -
The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
-
duplicates_dropped_countinteger -
The number of attack discoveries dropped as duplicates during the persist step
-
endstring -
When generation ended (max event.end)
-
error_categorystring -
Structured error category from server classification (optional; absent for successful generations)
-
execution_uuidstringrequired -
The unique identifier (kibana.alert.rule.execution.uuid) for the generation
-
failed_workflow_idstring -
Workflow ID that caused the failure (optional; absent for successful generations)
-
generated_countinteger -
The number of attack discoveries generated before deduplication and hallucination filtering
-
hallucinations_filtered_countinteger -
The number of attack discoveries filtered as hallucinations during the validation step
-
loading_messagestring -
Generation loading message (kibana.alert.rule.execution.status)
-
persisted_countinteger -
The number of attack discoveries successfully persisted after deduplication and hallucination filtering
-
reasonstring -
Reason for failed generations (event.reason)
-
source_metadataobjectnullable -
Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
-
action_execution_uuidstring -
The action execution UUID from the alerting framework
-
rule_idstring -
The ID of the alerting rule that triggered this generation
-
rule_namestring -
The name of the alerting rule that triggered this generation
-
startstringrequired -
When generation started (min event.start)
-
status -
The status of the attack discovery generation
-
Values:
canceleddismissedfailedstartedsucceeded -
step_event_actionsstring -
Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.
-
workflow_executions -
Workflow execution tracking for manual orchestration
-
alertRetrievalobjectnullable -
Alert retrieval workflow executions (one per workflow invoked)
-
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
gateobjectnullable -
Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers
-
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
generation -
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
validation -
workflowIdstringrequired -
The workflow definition ID
-
workflowNamestring -
The human-readable workflow name (optional; used by the UI to display a label)
-
workflowRunIdstringrequired -
The workflow execution ID
-
workflow_idstring -
The workflow definition ID for deep linking
-
workflow_run_idstring -
The workflow execution ID for monitoring
Bad Request response.
-
errorstringrequired -
Error type
-
messagestringrequired -
Human-readable error message describing what went wrong with the request
-
status_codenumberrequired -
HTTP status code