Generate attack discoveries from alerts
https://{kibana_url}
- POST /api/attack_discovery/_generate
- POST /s/{space_id}/api/attack_discovery/_generate
Refer to Spaces for more information.
Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.
Request
-
alertsIndexPatternstringrequired -
The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default
-
anonymizationFieldsobjectrequired -
The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the
/api/security_ai_assistant/anonymization_fields/_findAPI (for a specific Kibana space) to provide this value. -
allowedboolean -
Whether this field is allowed to be sent to the model.
-
anonymizedboolean -
Whether this field should be anonymized.
-
createdAtstring -
Timestamp of when the anonymization field was created.
-
createdBystring -
Username of the person who created the anonymization field.
-
fieldstringrequired -
Name of the anonymization field.
-
idstring · min: 1required -
A string that does not contain only whitespace characters.
-
namespacestring -
Kibana space in which this anonymization field exists.
-
timestampstring · min: 1 -
A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
-
updatedAtstring -
Timestamp of the last update.
-
updatedBystring -
Username of the person who last updated the field.
-
apiConfig -
actionTypeIdstringrequired -
Action type ID
-
connectorIdstringrequired -
Connector ID
-
defaultSystemPromptIdstring -
Default system prompt ID
-
modelstring -
Model
-
connectorNamestring -
endstring -
filterobject -
An Elasticsearch-style query DSL object used to filter alerts. For example:
"filter": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "term": { "user.name": { "value": "james" } } } ], "minimum_should_match": 1 } } ], "should": [], "must_not": [] } } } ``` -
modelstring -
replacementsobject -
Replacements object used to anonymize/deanonymize messages
-
sizenumberrequired -
startstring -
subAction -
Values:
invokeAIinvokeStream
Responses
Indicates a successful call.
-
execution_uuidstring · min: 1required -
A string that does not contain only whitespace characters.
Bad Request response.
-
errorstringrequired -
Error type
-
messagestringrequired -
Human-readable error message describing what went wrong
-
status_codenumberrequired -
HTTP status code