Find Attack discoveries that match the search criteria

Base URL
https://{kibana_url}
  • GET /api/attack_discovery/_find
Auth

Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.

Query parameters

alert_ids string[]

Filter results to Attack discoveries that include any of the provided alert IDs

connector_names string[]

Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable connector_name property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from connector_id values used to generate Attack discoveries.

enable_field_rendering boolean · default: false

Enables a markdown syntax used to render pivot fields, for example {{ user.name james }}. When disabled, the same example would be rendered as james. This is primarily used for Attack Discovery views within Kibana. Defaults to false.

end string

End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").

Example: now
ids string[]

Filter results to the Attack discoveries with the specified IDs

include_unique_alert_ids boolean

If true, the response will include unique_alert_ids and unique_alert_ids_count aggregated across the matched Attack discoveries

page integer · min: 1 · default: 1

Page number to return (used for pagination). Defaults to 1.

per_page integer · min: 1 · default: 10

Number of Attack discoveries to return per page (used for pagination). Defaults to 10.

Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)

shared boolean

Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use true to return only shared discoveries, false to return only those visible to the current user. Mutually exclusive with include_all_authors.

include_all_authors boolean

If true, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with shared.

scheduled boolean

Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use true to return only scheduled discoveries or false to return only ad-hoc discoveries.

sort_field enum

Field used to sort results. See AttackDiscoveryFindSortField for allowed values.

Values: @timestamp
sort_order enum

Sort order direction asc for ascending or desc for descending. Defaults to desc.

Values: asc desc
start string

Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

Example: now-24h
status enum[]

Filter by alert workflow status. Provide one or more of the allowed workflow states.

Values: acknowledged closed open
with_replacements boolean · default: true

When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.

Responses

Indicates a successful call.

application/json
connector_names string[] required

List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.

data object[] required

Array of matched Attack discovery objects. Each item follows the AttackDiscoveryApiAlert schema.

alert_ids string[] required

The alert IDs that the attack discovery is based on

alert_rule_uuid string

The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)

alert_start string

The optional time the attack discovery alert was created

alert_updated_at string

The optional time the attack discovery alert was last updated

alert_updated_by_user_id string

The optional id of the user who last updated the attack discovery alert

alert_updated_by_user_name string

The optional username of the user who updated the attack discovery alert

alert_workflow_reason string

The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed

alert_workflow_status string

The optional kibana.alert.workflow_status of this attack discovery

alert_workflow_status_updated_at string

The optional time the attack discovery alert workflow status was last updated

assignees string[]

The optional array of user-IDs who have been assigned the attack

connector_id string required

The ID of the connector that generated the attack discovery

connector_name string required

The (human readable) name of the connector that generated the attack discovery

details_markdown string required

Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.

entity_summary_markdown string

An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax

generation_uuid string required

The generation ID of the run that created the attack discovery

id string required

The unique ID of the attack discovery

index string

The concrete Elasticsearch index where this attack discovery is stored

mitre_attack_tactics string[]

An optional array of MITRE ATT&CK tactic for the attack discovery

replacements map string to string

Replacements object used to anonymize/deanonymize messages

risk_score integer

The optional, (but typically populated after generation) risk score of the alert

summary_markdown string required

A markdown summary of attack discovery, using the same syntax

tags string[]

The optional array of tags assigned the attack

timestamp string · format: nonempty · min length: 1 required

A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.

title string required

A title for the attack discovery, in plain text

user_id string

The optional id of the user who generated the attack discovery

user_name string

The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)

users object[]

The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.

id string

User id.

name string

User name.

page integer required

Current page number of the paginated result set.

per_page integer required

Number of items requested per page.

total integer required

Total number of Attack discoveries matching the query (across all pages).

unique_alert_ids string[]

List of unique alert IDs aggregated from the matched Attack discoveries. Only present if include_unique_alert_ids=true in the request.

unique_alert_ids_count integer required

Number of unique alert IDs across all matched Attack discoveries. Only present if include_unique_alert_ids=true in the request.

Bad Request response.

application/json
error string

Error type

message string

Human-readable error message

status_code number

HTTP status code

Base URL
https://{kibana_url}