Generate attack discoveries from alerts
- Base URL
-
https://{kibana_url}
- POST /api/attack_discovery/_generate
- POST /s/{space_id}/api/attack_discovery/_generate
Refer to Spaces for more information.
Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.
Request body
-
alertsIndexPatternstringrequired -
The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default
-
anonymizationFieldsobjectrequired -
The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the
/api/security_ai_assistant/anonymization_fields/_findAPI (for a specific Kibana space) to provide this value.
Responses
Indicates a successful call.