Get the latest Attack Discovery generations metadata for the current user

Base URL
https://{kibana_url}
  • GET /api/attack_discovery/generations
Auth

Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.

Query parameters

end string

End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").

Example: now
size number · min: 1 · default: 50

The maximum number of generations to retrieve

scheduled boolean

Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use true to return only scheduled generations or false to return only ad-hoc (interactive or action-triggered) generations.

start string

Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

Example: now-24h

Responses

Indicates a successful call.

application/json
generations object[] required

List of Attack Discovery generations

alerts_context_count number

The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation

connector_id string required

The connector id (event.dataset) for this generation

connector_stats object

Stats applicable to the connector for this generation

average_successful_duration_nanoseconds number

The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user

successful_generations number

The number of successful generations for the same connector id, for the current user

conversation_id string

Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)

discoveries number required

The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation

duplicates_dropped_count integer

The number of attack discoveries dropped as duplicates during the persist step

end string

When generation ended (max event.end)

error_category string

Structured error category from server classification (optional; absent for successful generations)

execution_uuid string required

The unique identifier (kibana.alert.rule.execution.uuid) for the generation

failed_workflow_id string

Workflow ID that caused the failure (optional; absent for successful generations)

generated_count integer

The number of attack discoveries generated before deduplication and hallucination filtering

hallucinations_filtered_count integer

The number of attack discoveries filtered as hallucinations during the validation step

loading_message string

Generation loading message (kibana.alert.rule.execution.status)

persisted_count integer

The number of attack discoveries successfully persisted after deduplication and hallucination filtering

reason string

Reason for failed generations (event.reason)

source_metadata object nullable

Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)

action_execution_uuid string

The action execution UUID from the alerting framework

rule_id string

The ID of the alerting rule that triggered this generation

rule_name string

The name of the alerting rule that triggered this generation

start string required

When generation started (min event.start)

status enum required

The status of the attack discovery generation

Values: canceled dismissed failed started succeeded
step_event_actions string[]

Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.

workflow_executions object

Workflow execution tracking for manual orchestration

alertRetrieval object[] nullable

Alert retrieval workflow executions (one per workflow invoked)

workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

gate object[] nullable

Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers

workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

generation object
workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

validation object
workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

workflow_id string

The workflow definition ID for deep linking

workflow_run_id string

The workflow execution ID for monitoring

Bad Request response.

application/json
error string

Error type

message string

Human-readable error message

status_code number

HTTP status code

Base URL
https://{kibana_url}