---
type: api
title: Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-getattackdiscoverygeneration
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-getattackdiscoverygeneration
products:
  - Kibana
---

# Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/attack_discovery/generations/{execution_uuid}`
- `GET` `/s/{space_id}/api/attack_discovery/generations/{execution_uuid}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

#### Path Parameters

- `execution_uuid` (string · min: 1)
  The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.

## Query String Parameters

- `enable_field_rendering` (boolean · default: false)
  Enables a markdown syntax used to render pivot fields, for example ``{{ user.name james }}``. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
- `with_replacements` (boolean · default: true)
  When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` ([] object)
  Array of Attack discoveries generated during this execution.
  - `alert_ids` ([] string)
    The alert IDs that the attack discovery is based on
  - `alert_rule_uuid` (string)
    The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
  - `alert_start` (string)
    The optional time the attack discovery alert was created
  - `alert_updated_at` (string)
    The optional time the attack discovery alert was last updated
  - `alert_updated_by_user_id` (string)
    The optional id of the user who last updated the attack discovery alert
  - `alert_updated_by_user_name` (string)
    The optional username of the user who updated the attack discovery alert
  - `alert_workflow_status` (string)
    The optional kibana.alert.workflow_status of this attack discovery
  - `alert_workflow_status_updated_at` (string)
    The optional time the attack discovery alert workflow status was last updated
  - `assignees` ([] string)
    The optional array of user-IDs who have been assigned the attack
  - `connector_id` (string)
    The ID of the connector that generated the attack discovery
  - `connector_name` (string)
    The (human readable) name of the connector that generated the attack discovery
  - `details_markdown` (string)
    Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
  - `entity_summary_markdown` (string)
    An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
  - `generation_uuid` (string)
    The generation ID of the run that created the attack discovery
  - `id` (string)
    The unique ID of the attack discovery
  - `index` (string)
    The concrete Elasticsearch index where this attack discovery is stored
  - `mitre_attack_tactics` ([] string)
    An optional array of MITRE ATT&CK tactic for the attack discovery
  - `replacements` (object)
    Replacements object used to anonymize/deanonymize messages
  - `risk_score` (integer)
    The optional, (but typically populated after generation) risk score of the alert
  - `summary_markdown` (string)
    A markdown summary of attack discovery, using the same syntax
  - `tags` ([] string)
    The optional array of tags assigned the attack
  - `timestamp` (string · min: 1)
    A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
  - `title` (string)
    A title for the attack discovery, in plain text
  - `user_id` (string)
    The optional id of the user who generated the attack discovery
  - `user_name` (string)
    The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
  - `users` ([] object)
    The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.
    - `id` (string)
      User id.
    - `name` (string)
      User name.
- `generation` ({})
  - `alerts_context_count` (number)
    The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
  - `connector_id` (string)
    The connector id (event.dataset) for this generation
  - `connector_stats` (object)
    Stats applicable to the connector for this generation
    - `average_successful_duration_nanoseconds` (number)
      The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
    - `successful_generations` (number)
      The number of successful generations for the same connector id, for the current user
  - `conversation_id` (string)
    Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
  - `discoveries` (number)
    The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
  - `duplicates_dropped_count` (integer)
    The number of attack discoveries dropped as duplicates during the persist step
  - `end` (string)
    When generation ended (max event.end)
  - `error_category` (string)
    Structured error category from server classification (optional; absent for successful generations)
  - `execution_uuid` (string)
    The unique identifier (kibana.alert.rule.execution.uuid) for the generation
  - `failed_workflow_id` (string)
    Workflow ID that caused the failure (optional; absent for successful generations)
  - `generated_count` (integer)
    The number of attack discoveries generated before deduplication and hallucination filtering
  - `hallucinations_filtered_count` (integer)
    The number of attack discoveries filtered as hallucinations during the validation step
  - `loading_message` (string)
    Generation loading message (kibana.alert.rule.execution.status)
  - `persisted_count` (integer)
    The number of attack discoveries successfully persisted after deduplication and hallucination filtering
  - `reason` (string)
    Reason for failed generations (event.reason)
  - `source_metadata` (object) — nullable
    Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
    - `action_execution_uuid` (string)
      The action execution UUID from the alerting framework
    - `rule_id` (string)
      The ID of the alerting rule that triggered this generation
    - `rule_name` (string)
      The name of the alerting rule that triggered this generation
  - `start` (string)
    When generation started (min event.start)
  - `status` (enum)
    The status of the attack discovery generation
    Values: `canceled`, `dismissed`, `failed`, `started`, `succeeded`
  - `step_event_actions` ([] string)
    Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.
  - `workflow_executions` ({})
    Workflow execution tracking for manual orchestration
    - `alertRetrieval` ([] object) — nullable
      Alert retrieval workflow executions (one per workflow invoked)
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `gate` ([] object) — nullable
      Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `generation` ({})
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
    - `validation` ({})
      - `workflowId` (string)
        The workflow definition ID
      - `workflowName` (string)
        The human-readable workflow name (optional; used by the UI to display a label)
      - `workflowRunId` (string)
        The workflow execution ID
  - `workflow_id` (string)
    The workflow definition ID for deep linking
  - `workflow_run_id` (string)
    The workflow execution ID for monitoring
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message describing what went wrong with the request
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request GET 'http://localhost:5601/api/attack_discovery/generations/2e13f386-46cf-4d65-9e2b-68609e132ba5' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"
```

## Response Examples

#### Single Attack Discovery generation with its discoveries and metadata.

```json
{
  "data": [
    {
      "id": "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "title": "Suspicious process execution on host-01"
    }
  ],
  "generation": {
    "alerts_context_count": 50,
    "discoveries": 1,
    "end": "2025-09-29T06:42:44.810Z",
    "execution_uuid": "2e13f386-46cf-4d65-9e2b-68609e132ba5",
    "start": "2025-09-29T06:42:08.962Z",
    "status": "succeeded"
  }
}
```

#### Bad Request error returned when the get-generation request is invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}
```