Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata

Base URL: https://{kibana_url}

GET /api/attack_discovery/generations/{execution_uuid}

Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Query parameters

Responses

Indicates a successful call.

application/json

data object[] required: Array of Attack discoveries generated during this execution.
generation object

Bad Request response.

application/json

Base URL: https://{kibana_url}

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request GET 'http://localhost:5601/api/attack_discovery/generations/2e13f386-46cf-4d65-9e2b-68609e132ba5' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"

Response

{
  "data": [
    {
      "id": "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "title": "Suspicious process execution on host-01"
    }
  ],
  "generation": {
    "alerts_context_count": 50,
    "discoveries": 1,
    "end": "2025-09-29T06:42:44.810Z",
    "execution_uuid": "2e13f386-46cf-4d65-9e2b-68609e132ba5",
    "start": "2025-09-29T06:42:08.962Z",
    "status": "succeeded"
  }
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}