---
type: api
title: Bulk update Attack discoveries
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-postattackdiscoverybulk
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-postattackdiscoverybulk
products:
  - Kibana
---

# Bulk update Attack discoveries

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/attack_discovery/_bulk`
- `POST` `/s/{space_id}/api/attack_discovery/_bulk`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.

## Request Body

`application/json`

Bulk update parameters for Attack discoveries

- `update` (object) — required
  Configuration object containing all parameters for the bulk update operation
  - `enable_field_rendering` (boolean · default: false) — optional
    Enables a markdown syntax used to render pivot fields, for example ``{{ user.name james }}``. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
  - `ids` ([] string) — required
    Array of Attack Discovery IDs to update
  - `kibana_alert_workflow_status` (enum) — optional
    When provided, update the kibana.alert.workflow_status of the attack discovery alerts
    Values: `open`, `acknowledged`, `closed`
  - `visibility` (enum) — optional
    When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field
    Values: `not_shared`, `shared`
  - `with_replacements` (boolean · default: true) — optional
    When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` ([] object)
  Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request.
  - `alert_ids` ([] string)
    The alert IDs that the attack discovery is based on
  - `alert_rule_uuid` (string)
    The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
  - `alert_start` (string)
    The optional time the attack discovery alert was created
  - `alert_updated_at` (string)
    The optional time the attack discovery alert was last updated
  - `alert_updated_by_user_id` (string)
    The optional id of the user who last updated the attack discovery alert
  - `alert_updated_by_user_name` (string)
    The optional username of the user who updated the attack discovery alert
  - `alert_workflow_status` (string)
    The optional kibana.alert.workflow_status of this attack discovery
  - `alert_workflow_status_updated_at` (string)
    The optional time the attack discovery alert workflow status was last updated
  - `assignees` ([] string)
    The optional array of user-IDs who have been assigned the attack
  - `connector_id` (string)
    The ID of the connector that generated the attack discovery
  - `connector_name` (string)
    The (human readable) name of the connector that generated the attack discovery
  - `details_markdown` (string)
    Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
  - `entity_summary_markdown` (string)
    An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
  - `generation_uuid` (string)
    The generation ID of the run that created the attack discovery
  - `id` (string)
    The unique ID of the attack discovery
  - `index` (string)
    The concrete Elasticsearch index where this attack discovery is stored
  - `mitre_attack_tactics` ([] string)
    An optional array of MITRE ATT&CK tactic for the attack discovery
  - `replacements` (object)
    Replacements object used to anonymize/deanonymize messages
  - `risk_score` (integer)
    The optional, (but typically populated after generation) risk score of the alert
  - `summary_markdown` (string)
    A markdown summary of attack discovery, using the same syntax
  - `tags` ([] string)
    The optional array of tags assigned the attack
  - `timestamp` (string · min: 1)
    A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
  - `title` (string)
    A title for the attack discovery, in plain text
  - `user_id` (string)
    The optional id of the user who generated the attack discovery
  - `user_name` (string)
    The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
  - `users` ([] object)
    The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.
    - `id` (string)
      User id.
    - `name` (string)
      User name.
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message describing what went wrong with the bulk update request
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request POST 'http://localhost:5601/api/attack_discovery/_bulk' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data-raw '{
   "update": {
     "ids": [
       "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
       "5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
     ],
     "kibana_alert_workflow_status": "acknowledged"
   }
 }'
```

## Request Examples

#### Acknowledge two Attack discoveries in bulk.

```json
{
  "update": {
    "enable_field_rendering": false,
    "ids": [
      "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
    ],
    "kibana_alert_workflow_status": "acknowledged",
    "with_replacements": true
  }
}
```

## Response Examples

#### A successful bulk update response containing the modified Attack discoveries.

```json
{
  "data": [
    {
      "alert_ids": [
        "alert-abc-1"
      ],
      "alert_workflow_status": "acknowledged",
      "connector_id": "gen-ai-connector",
      "connector_name": "OpenAI GPT-4",
      "details_markdown": "- **Host** \u0060workstation-01\u0060 showed credential access patterns consistent with mimikatz.",
      "generation_uuid": "550e8400-e29b-41d4-a716-446655440000",
      "id": "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "summary_markdown": "A user account was compromised using mimikatz to dump credentials.",
      "timestamp": "2024-01-15T10:00:00.000Z",
      "title": "Credential theft via mimikatz"
    }
  ]
}
```

#### Bad Request error returned when the bulk update payload is invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}
```