Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata

Base URL
https://{kibana_url}
Auth

Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

execution_uuid string · format: nonempty · min length: 1 required

The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.

Example: 2e13f386-46cf-4d65-9e2b-68609e132ba5

Query parameters

enable_field_rendering boolean · default: false

Enables a markdown syntax used to render pivot fields, for example {{ user.name james }}. When disabled, the same example would be rendered as james. This is primarily used for Attack Discovery views within Kibana. Defaults to false.

with_replacements boolean · default: true

When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.

Responses

Indicates a successful call.

application/json
data object[] required

Array of Attack discoveries generated during this execution.

alert_ids string[] required

The alert IDs that the attack discovery is based on

alert_rule_uuid string

The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)

alert_start string

The optional time the attack discovery alert was created

alert_updated_at string

The optional time the attack discovery alert was last updated

alert_updated_by_user_id string

The optional id of the user who last updated the attack discovery alert

alert_updated_by_user_name string

The optional username of the user who updated the attack discovery alert

alert_workflow_reason string

The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed

alert_workflow_status string

The optional kibana.alert.workflow_status of this attack discovery

alert_workflow_status_updated_at string

The optional time the attack discovery alert workflow status was last updated

assignees string[]

The optional array of user-IDs who have been assigned the attack

connector_id string required

The ID of the connector that generated the attack discovery

connector_name string required

The (human readable) name of the connector that generated the attack discovery

details_markdown string required

Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.

entity_summary_markdown string

An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax

generation_uuid string required

The generation ID of the run that created the attack discovery

id string required

The unique ID of the attack discovery

index string

The concrete Elasticsearch index where this attack discovery is stored

mitre_attack_tactics string[]

An optional array of MITRE ATT&CK tactic for the attack discovery

replacements map string to string

Replacements object used to anonymize/deanonymize messages

risk_score integer

The optional, (but typically populated after generation) risk score of the alert

summary_markdown string required

A markdown summary of attack discovery, using the same syntax

tags string[]

The optional array of tags assigned the attack

timestamp string · format: nonempty · min length: 1 required

A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.

title string required

A title for the attack discovery, in plain text

user_id string

The optional id of the user who generated the attack discovery

user_name string

The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)

users object[]

The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.

id string

User id.

name string

User name.

generation object
alerts_context_count number

The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation

connector_id string required

The connector id (event.dataset) for this generation

connector_stats object

Stats applicable to the connector for this generation

average_successful_duration_nanoseconds number

The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user

successful_generations number

The number of successful generations for the same connector id, for the current user

conversation_id string

Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)

discoveries number required

The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation

duplicates_dropped_count integer

The number of attack discoveries dropped as duplicates during the persist step

end string

When generation ended (max event.end)

error_category string

Structured error category from server classification (optional; absent for successful generations)

execution_uuid string required

The unique identifier (kibana.alert.rule.execution.uuid) for the generation

failed_workflow_id string

Workflow ID that caused the failure (optional; absent for successful generations)

generated_count integer

The number of attack discoveries generated before deduplication and hallucination filtering

hallucinations_filtered_count integer

The number of attack discoveries filtered as hallucinations during the validation step

loading_message string

Generation loading message (kibana.alert.rule.execution.status)

persisted_count integer

The number of attack discoveries successfully persisted after deduplication and hallucination filtering

reason string

Reason for failed generations (event.reason)

source_metadata object nullable

Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)

action_execution_uuid string

The action execution UUID from the alerting framework

rule_id string

The ID of the alerting rule that triggered this generation

rule_name string

The name of the alerting rule that triggered this generation

start string required

When generation started (min event.start)

status enum required

The status of the attack discovery generation

Values: canceled dismissed failed started succeeded
step_event_actions string[]

Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.

workflow_executions object

Workflow execution tracking for manual orchestration

alertRetrieval object[] nullable

Alert retrieval workflow executions (one per workflow invoked)

workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

gate object[] nullable

Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers

workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

generation object
workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

validation object
workflowId string required

The workflow definition ID

workflowName string

The human-readable workflow name (optional; used by the UI to display a label)

workflowRunId string required

The workflow execution ID

workflow_id string

The workflow definition ID for deep linking

workflow_run_id string

The workflow execution ID for monitoring

Bad Request response.

application/json
error string required

Error type

message string required

Human-readable error message describing what went wrong with the request

status_code number required

HTTP status code

Base URL
https://{kibana_url}