Get Attack Discovery schedule by ID

Base URL: https://{kibana_url}

GET /api/attack_discovery/schedules/{id}
GET /s/{space_id}/api/attack_discovery/schedules/{id}

Refer to Spaces for more information.

Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.

Authentication

Path parameters

Responses

Successfully retrieved Attack Discovery schedule with complete configuration and metadata

application/json

actions union oneOf[] required: The Attack Discovery schedule actions; One of:
created_at string · format: date-time required: The date the schedule was created
created_by string required: The name of the user that created the schedule
enabled boolean required: Indicates whether the schedule is enabled
id string required: UUID of Attack Discovery schedule
last_execution object: An Attack Discovery schedule execution information
name string required: The name of the schedule
params object required: An Attack Discovery schedule params
schedule object required
updated_at string · format: date-time required: The date the schedule was updated
updated_by string required: The name of the user that updated the schedule

Bad Request response.

application/json

Base URL: https://{kibana_url}

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"

Response

{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "last_execution": {
    "date": "2023-10-31T10:00:00.000Z",
    "last_duration": 45.2,
    "status": "ok"
  },
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  },
  "updated_at": "2023-10-31T10:00:00.000Z",
  "updated_by": "elastic"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}