Create Attack Discovery schedule

Base URL: https://{kibana_url}

POST /api/attack_discovery/schedules
POST /s/{space_id}/api/attack_discovery/schedules

Refer to Spaces for more information.

Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Attack Discovery schedule configuration including name, parameters, schedule interval, and actions

actions union oneOf[]: The Attack Discovery schedule actions; One of:
enabled boolean: Indicates whether the schedule is enabled
name string required: The name of the schedule
params object required: An Attack Discovery schedule params
schedule object required

Responses

The Attack Discovery schedule was successfully created.

application/json

Bad Request response.

application/json

Base URL: https://{kibana_url}

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request POST 'http://localhost:5601/api/attack_discovery/schedules' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
   "name": "Daily Security Analysis",
   "enabled": true,
   "params": {
     "alerts_index_pattern": ".alerts-security.alerts-default",
     "api_config": {
       "actionTypeId": "bedrock",
       "connectorId": "my-bedrock-connector",
       "name": "Claude 3.5 Sonnet"
     },
     "size": 100,
     "start": "now-24h",
     "end": "now"
   },
   "schedule": {
     "interval": "24h"
   },
   "actions": [
      {
         "action_type_id": ".cases",
         "id": "system-connector-.cases",
         "params": {
           "subAction": "run",
           "subActionParams": {
             "timeWindow": "7d",
             "reopenClosedCases": false,
             "groupingBy": [],
             "templateId": null
           }
         },
         "uuid": "12345678-1234-1234-1234-123456789012"
       }
   ]
 }'

Request

Request example

{
  "actions": [],
  "enabled": true,
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  }
}

Response

{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  },
  "updated_at": "2023-10-31T10:00:00.000Z",
  "updated_by": "elastic"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}

Authentication

Request body { }

Responses

Request body