Find Attack Discovery schedules that match the search criteria

Base URL
https://{kibana_url}
  • GET /api/attack_discovery/schedules/_find
Auth

Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.

Query parameters

page number

Page number to return (used for pagination). Defaults to 1.

per_page number

Number of Attack Discovery schedules to return per page (used for pagination). Defaults to 10.

sort_field string · format: nonempty · min length: 1

Field used to sort results. Common fields include 'name', 'created_at', 'updated_at', and 'enabled'.

Example: name
sort_direction enum

Sort order direction. Use 'asc' for ascending or 'desc' for descending. Defaults to 'asc'.

Values: asc desc

Responses

Indicates a successful call.

application/json
data object[] required

Array of matched Attack Discovery schedule objects.

actions union oneOf[] required

The Attack Discovery schedule actions

One of:
action_type_id string required

The action type used for sending notifications.

alerts_filter object
frequency object

The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).

notify_when enum required

The condition for throttling the notification: onActionGroupChange, onActiveAlert, or onThrottleInterval

Values: onActiveAlert onThrottleInterval onActionGroupChange
summary boolean required

Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert

throttle string · pattern: ^[1-9]\d*[smhd]$ required

Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.

group string required

Groups actions by use cases. Use default for alert notifications.

id string required

The connector ID.

params object required

Object containing the allowed connector fields, which varies according to the connector type.

uuid string · format: nonempty · min length: 1

A string that does not contain only whitespace characters.

created_at string · format: date-time required

The date the schedule was created

created_by string required

The name of the user that created the schedule

enabled boolean required

Indicates whether the schedule is enabled

id string required

UUID of Attack Discovery schedule

last_execution object

An Attack Discovery schedule execution information

date string · format: date-time required

Date of the execution

duration number

Duration of the execution

message string
status enum required

An Attack Discovery schedule execution status

Values: ok active error unknown warning
name string required

The name of the schedule

params object required

An Attack Discovery schedule params

alerts_index_pattern string required

The index pattern to get alerts from

api_config object required

LLM API configuration.

actionTypeId string required

Action type ID

connectorId string required

Connector ID

defaultSystemPromptId string

Default system prompt ID

model string

Model

provider enum

Provider

Values: OpenAI Azure OpenAI Other
name string required

The name of the connector

combined_filter object
end string
filters object[]

The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.

query object

An query condition to filter alerts

language string required
query string | object required
size number required
start string
schedule object required
interval string required

The schedule interval

updated_at string · format: date-time required

The date the schedule was updated

updated_by string required

The name of the user that updated the schedule

page number required

Current page number of the paginated result set.

per_page number required

Number of items requested per page.

total number required

Total number of Attack Discovery schedules matching the query (across all pages).

Bad Request response.

application/json
error string

Error type

message string

Human-readable error message

status_code number

HTTP status code

Base URL
https://{kibana_url}