Get the latest Attack Discovery generations metadata for the current user
- Base URL
-
https://{kibana_url}
- GET /api/attack_discovery/generations
- GET /s/{space_id}/api/attack_discovery/generations
Refer to Spaces for more information.
Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.
Query parameters
Responses
Indicates a successful call.
-
generationsobjectrequired -
List of Attack Discovery generations
-
alerts_context_countnumber -
The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
-
conversation_idstring -
Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
-
discoveriesnumberrequired -
The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
-
duplicates_dropped_countinteger -
The number of attack discoveries dropped as duplicates during the persist step
-
error_categorystring -
Structured error category from server classification (optional; absent for successful generations)
-
execution_uuidstringrequired -
The unique identifier (kibana.alert.rule.execution.uuid) for the generation
-
failed_workflow_idstring -
Workflow ID that caused the failure (optional; absent for successful generations)
-
generated_countinteger -
The number of attack discoveries generated before deduplication and hallucination filtering
-
hallucinations_filtered_countinteger -
The number of attack discoveries filtered as hallucinations during the validation step
-
persisted_countinteger -
The number of attack discoveries successfully persisted after deduplication and hallucination filtering
-
source_metadataobjectnullable -
Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
-
statusrequired -
The status of the attack discovery generation
-
Values:
canceleddismissedfailedstartedsucceeded -
step_event_actionsstring -
Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.