Dismiss an Attack Discovery generation

Base URL: https://{kibana_url}

POST /api/attack_discovery/generations/{execution_uuid}/_dismiss
POST /s/{space_id}/api/attack_discovery/generations/{execution_uuid}/_dismiss

Refer to Spaces for more information.

Dismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI. This sets the generation's status to "dismissed" and affects how the generation appears in subsequent queries.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Responses

Indicates a successful call.

application/json

alerts_context_count number: The number of alerts that were sent as context to the LLM for this generation.
connector_id string required: The unique identifier of the connector used to generate the attack discoveries.
connector_stats object: Statistical information about the connector's performance for this user, providing insights into usage patterns and success rates.
discoveries number required: The number of attack discoveries that were generated during this execution.
end string: The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven't finished.
execution_uuid string required: The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls.
loading_message string: A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing.
reason string: Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process.
start string required: The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis.
status enum required: The current status of the attack discovery generation. After dismissing, this will be set to "dismissed".; Values: canceled dismissed failed started succeeded

Bad Request response.

application/json

Base URL: https://{kibana_url}

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request POST 'http://localhost:5601/api/attack_discovery/generations/46b218d5-535d-4329-be56-d0f6af6986b7/_dismiss' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"

Response

{
  "alerts_context_count": 75,
  "connector_id": "chatGpt5_0ChatAzure",
  "discoveries": 3,
  "end": "2025-09-29T06:42:44.810Z",
  "execution_uuid": "46b218d5-535d-4329-be56-d0f6af6986b7",
  "loading_message": "AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.",
  "start": "2025-09-29T06:42:08.962Z",
  "status": "dismissed"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}