Update Attack Discovery schedule
https://{kibana_url}
- PUT /api/attack_discovery/schedules/{id}
- PUT /s/{space_id}/api/attack_discovery/schedules/{id}
Refer to Spaces for more information.
Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.
Path Parameters
-
idstring · min: 1required -
The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.
Request
Updated Attack Discovery schedule configuration. All fields are required as this replaces the entire schedule configuration.
-
actions -
The Attack Discovery schedule actions
-
action_type_idstringrequired -
The action type used for sending notifications.
-
alerts_filterobject -
frequency -
The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
-
notify_when -
The condition for throttling the notification:
onActionGroupChange,onActiveAlert, oronThrottleInterval -
Values:
onActiveAlertonThrottleIntervalonActionGroupChange -
summarybooleanrequired -
Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
-
throttlestring · pattern: ^[1-9]\d*[smhd]$required -
Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
-
groupstringrequired -
Groups actions by use cases. Use
defaultfor alert notifications. -
idstringrequired -
The connector ID.
-
paramsobjectrequired -
Object containing the allowed connector fields, which varies according to the connector type.
-
uuidstring · min: 1 -
A string that does not contain only whitespace characters.
-
action_type_idstringrequired -
The action type used for sending notifications.
-
idstringrequired -
The connector ID.
-
paramsobjectrequired -
Object containing the allowed connector fields, which varies according to the connector type.
-
uuidstring · min: 1 -
A string that does not contain only whitespace characters.
-
namestringrequired -
The name of the schedule
-
params -
An Attack Discovery schedule params
-
alerts_index_patternstringrequired -
The index pattern to get alerts from
-
api_config -
LLM API configuration.
-
actionTypeIdstringrequired -
Action type ID
-
connectorIdstringrequired -
Connector ID
-
defaultSystemPromptIdstring -
Default system prompt ID
-
modelstring -
Model
-
namestringrequired -
The name of the connector
-
combined_filterobject -
endstring -
filtersobject -
The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
-
sizenumberrequired -
startstring
Responses
Successfully updated Attack Discovery schedule with the new configuration and metadata
-
actions -
The Attack Discovery schedule actions
-
created_atstringrequired -
The date the schedule was created
-
created_bystringrequired -
The name of the user that created the schedule
-
enabledbooleanrequired -
Indicates whether the schedule is enabled
-
idstringrequired -
UUID of Attack Discovery schedule
-
last_execution -
An Attack Discovery schedule execution information
-
namestringrequired -
The name of the schedule
-
params -
An Attack Discovery schedule params
-
updated_atstringrequired -
The date the schedule was updated
-
updated_bystringrequired -
The name of the user that updated the schedule
Bad Request response.
-
errorstring -
Error type
-
messagestring -
Human-readable error message describing what went wrong
-
status_codenumber -
HTTP status code