---
type: api
title: Update Attack Discovery schedule
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-updateattackdiscoveryschedules
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-updateattackdiscoveryschedules
products:
  - Kibana
---

# Update Attack Discovery schedule

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/attack_discovery/schedules/{id}`
- `PUT` `/s/{space_id}/api/attack_discovery/schedules/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

#### Path Parameters

- `id` (string · min: 1)
  The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.

## Request Body

`application/json`

Updated Attack Discovery schedule configuration. All fields are required as this replaces the entire schedule configuration.

- `actions` ([] union) — required
  The Attack Discovery schedule actions
  - **AttackDiscoveryApiScheduleGeneralAction**
    - `action_type_id` (string) — required
      The action type used for sending notifications.
    - `alerts_filter` (object) — optional
    - `frequency` ({}) — optional
      The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
      - `notify_when` (enum) — required
        The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`,  or `onThrottleInterval`
        Values: `onActiveAlert`, `onThrottleInterval`, `onActionGroupChange`
      - `summary` (boolean) — required
        Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
      - `throttle` (string · pattern: ^[1-9]\d*[smhd]$) — required
        Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
    - `group` (string) — required
      Groups actions by use cases. Use `default` for alert notifications.
    - `id` (string) — required
      The connector ID.
    - `params` (object) — required
      Object containing the allowed connector fields, which varies according to the connector type.
    - `uuid` (string · min: 1) — optional
      A string that does not contain only whitespace characters.
  - **AttackDiscoveryApiScheduleSystemAction**
    - `action_type_id` (string) — required
      The action type used for sending notifications.
    - `id` (string) — required
      The connector ID.
    - `params` (object) — required
      Object containing the allowed connector fields, which varies according to the connector type.
    - `uuid` (string · min: 1) — optional
      A string that does not contain only whitespace characters.
- `name` (string) — required
  The name of the schedule
- `params` ({}) — required
  An Attack Discovery schedule params
  - `alerts_index_pattern` (string) — required
    The index pattern to get alerts from
  - `api_config` ({}) — required
    LLM API configuration.
    - `actionTypeId` (string) — required
      Action type ID
    - `connectorId` (string) — required
      Connector ID
    - `defaultSystemPromptId` (string) — optional
      Default system prompt ID
    - `model` (string) — optional
      Model
    - `provider` (enum) — optional
      Provider
      Values: `OpenAI`, `Azure OpenAI`, `Other`
    - `name` (string) — required
      The name of the connector
  - `combined_filter` (object) — optional
  - `end` (string) — optional
  - `filters` ([] object) — optional
    The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
  - `query` ({}) — optional
    An query condition to filter alerts
    - `language` (string) — required
    - `query` (string | object) — required
  - `size` (number) — required
  - `start` (string) — optional
- `schedule` ({}) — required
  - `interval` (string) — required
    The schedule interval

## Responses

#### `200`

Successfully updated Attack Discovery schedule with the new configuration and metadata

`application/json`

- `actions` ([] union)
  The Attack Discovery schedule actions
  Same options as `actions`
- `created_at` (string)
  The date the schedule was created
- `created_by` (string)
  The name of the user that created the schedule
- `enabled` (boolean)
  Indicates whether the schedule is enabled
- `id` (string)
  UUID of Attack Discovery schedule
- `last_execution` ({})
  An Attack Discovery schedule execution information
  - `date` (string)
    Date of the execution
  - `duration` (number)
    Duration of the execution
  - `message` (string)
  - `status` (enum)
    An Attack Discovery schedule execution status
    Values: `ok`, `active`, `error`, `unknown`, `warning`
- `name` (string)
  The name of the schedule
- `params` ({})
  An Attack Discovery schedule params
  Same fields as `params`
- `schedule` ({})
  - `interval` (string)
    The schedule interval
- `updated_at` (string)
  The date the schedule was updated
- `updated_by` (string)
  The name of the user that updated the schedule
#### `400`

Bad Request response.

`application/json`

- `error` (string)
  Error type
- `message` (string)
  Human-readable error message describing what went wrong
- `status_code` (number)
  HTTP status code
## Code Examples

#### curl

```curl
curl \
 --request PUT 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
   "name": "Updated Daily Security Analysis",
   "params": {
     "alerts_index_pattern": ".alerts-security.alerts-default",
     "api_config": {
       "actionTypeId": "bedrock",
       "connectorId": "my-bedrock-connector",
       "name": "Claude 3.5 Sonnet"
     },
     "size": 200,
     "start": "now-48h",
     "end": "now"
   },
   "schedule": {
     "interval": "12h"
   },
   "actions": []
 }'
```

## Request Examples

#### Update an Attack Discovery schedule to run every 12 hours over a 48-hour window.

```json
{
  "actions": [],
  "name": "Updated Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 200,
    "start": "now-48h"
  },
  "schedule": {
    "interval": "12h"
  }
}
```

## Response Examples

#### An Attack Discovery schedule after being updated.

```json
{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "name": "Updated Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 200,
    "start": "now-48h"
  },
  "schedule": {
    "interval": "12h"
  },
  "updated_at": "2023-10-31T12:00:00.000Z",
  "updated_by": "elastic"
}
```

#### Bad Request error returned when the update schedule payload is invalid.

```json
{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}
```