Get Attack Discovery schedule by ID

Base URL: https://{kibana_url}

GET /api/attack_discovery/schedules/{id}
GET /s/{space_id}/api/attack_discovery/schedules/{id}

Refer to Spaces for more information.

Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Responses

Successfully retrieved Attack Discovery schedule with complete configuration and metadata

application/json

actions union oneOf[] required: The Attack Discovery schedule actions; One of:
created_at string · format: date-time required: The date the schedule was created
created_by string required: The name of the user that created the schedule
enabled boolean required: Indicates whether the schedule is enabled
id string required: UUID of Attack Discovery schedule
last_execution object: An Attack Discovery schedule execution information
name string required: The name of the schedule
params object required: An Attack Discovery schedule params
schedule object required
updated_at string · format: date-time required: The date the schedule was updated
updated_by string required: The name of the user that updated the schedule

Bad Request response.

application/json

Base URL: https://{kibana_url}

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"

Response

{
  "actions": [],
  "created_at": "2023-10-31T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "12345678-1234-1234-1234-123456789012",
  "last_execution": {
    "date": "2023-10-31T10:00:00.000Z",
    "last_duration": 45.2,
    "status": "ok"
  },
  "name": "Daily Security Analysis",
  "params": {
    "alerts_index_pattern": ".alerts-security.alerts-default",
    "api_config": {
      "actionTypeId": "bedrock",
      "connectorId": "my-bedrock-connector",
      "name": "Claude 3.5 Sonnet"
    },
    "end": "now",
    "size": 100,
    "start": "now-24h"
  },
  "schedule": {
    "interval": "24h"
  },
  "updated_at": "2023-10-31T10:00:00.000Z",
  "updated_by": "elastic"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}