Grant access to Attack Discovery

To use Attack Discovery, your role needs specific privileges.

Ensure your role has:

Minimum Kibana privileges for these Security features:
- All for Attack discovery
- At least Read for Rules
- At least Read for Alerts
The appropriate index privileges, based on what you want to do with Attack Discovery alerts:

Action	Indices	Elasticsearch privileges
Read Attack Discovery alerts	- `.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`	`read` and `view_index_metadata`
Read and modify Attack Discovery alerts. This includes: - Generating discovery alerts manually - Generating discovery alerts using schedules - Sharing manually created alerts with other users - Updating a discovery's status	- `.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`	`read`, `view_index_metadata`, `write`, and `maintenance`

Ensure your role has:

All Kibana privileges for the Security > Attack discovery Kibana feature and at least Read privileges for the Security > Rules, Alerts, and Exceptions Kibana feature.
The appropriate index privileges, based on what you want to do with Attack Discovery alerts:

Action	Indices	Elasticsearch privileges
Read Attack Discovery alerts	- `.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`	`read` and `view_index_metadata`
Read and modify Attack Discovery alerts. This includes: - Generating discovery alerts manually - Generating discovery alerts using schedules - Sharing manually created alerts with other users - Updating a discovery's status	- `.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`	`read`, `view_index_metadata`, `write`, and `maintenance`

Ensure your role has:

All Kibana privileges for the Security > Attack discovery Kibana feature and at least Read privileges for the Security > Rules, Alerts, and Exceptions Kibana feature.
The appropriate index privileges, based on what you want to do with Attack Discovery alerts:

Action	Indices	Elasticsearch privileges
Read Attack Discovery alerts	- `.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`	`read` and `view_index_metadata`
Read and modify Attack Discovery alerts. This includes: - Generating discovery alerts manually - Generating discovery alerts using schedules - Sharing manually created alerts with other users - Updating a discovery's status	- `.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>` - `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`	`read`, `view_index_metadata`, `write`, and `maintenance`

Ensure your role has All Kibana privileges for the Security > Attack discovery Kibana feature.

attack-discovery-rbac