Find Attack discoveries that match the search criteria

Base URL: https://{kibana_url}

GET /api/attack_discovery/_find
GET /s/{space_id}/api/attack_discovery/_find

Refer to Spaces for more information.

Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

alert_ids string[]: Filter results to Attack discoveries that include any of the provided alert IDs
connector_names string[]: Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable connector_name property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from connector_id values used to generate Attack discoveries.
enable_field_rendering boolean · default: false: Enables a markdown syntax used to render pivot fields, for example {{ user.name james }}. When disabled, the same example would be rendered as james. This is primarily used for Attack Discovery views within Kibana. Defaults to false.
end string: End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").; Example: now
ids string[]: Filter results to the Attack discoveries with the specified IDs
include_unique_alert_ids boolean: If true, the response will include unique_alert_ids and unique_alert_ids_count aggregated across the matched Attack discoveries
page integer · min: 1 · default: 1: Page number to return (used for pagination). Defaults to 1.
per_page integer · min: 1 · default: 10: Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
search string: Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
shared boolean: Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use true to return only shared discoveries, false to return only those visible to the current user. Mutually exclusive with include_all_authors.
include_all_authors boolean: If true, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with shared.
scheduled boolean: Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use true to return only scheduled discoveries or false to return only ad-hoc discoveries.
sort_field enum: Field used to sort results. See AttackDiscoveryFindSortField for allowed values.; Values: @timestamp
sort_order enum: Sort order direction asc for ascending or desc for descending. Defaults to desc.; Values: asc desc
start string: Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").; Example: now-24h
status enum[]: Filter by alert workflow status. Provide one or more of the allowed workflow states.; Values: acknowledged closed open
with_replacements boolean · default: true: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.

Responses

Indicates a successful call.

application/json

connector_names string[] required: List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
data object[] required: Array of matched Attack discovery objects. Each item follows the AttackDiscoveryApiAlert schema.
page integer required: Current page number of the paginated result set.
per_page integer required: Number of items requested per page.
total integer required: Total number of Attack discoveries matching the query (across all pages).
unique_alert_ids string[]: List of unique alert IDs aggregated from the matched Attack discoveries. Only present if include_unique_alert_ids=true in the request.
unique_alert_ids_count integer required: Number of unique alert IDs across all matched Attack discoveries. Only present if include_unique_alert_ids=true in the request.

Bad Request response.

application/json