---
title: Grant access to Attack Discovery
description: To use Attack Discovery, your role needs specific privileges. 
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/grant-access
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Grant access to Attack Discovery
To use Attack Discovery, your role needs specific privileges.
<applies-switch>
  <applies-item title="{ "stack": "ga 9.4+", "serverless": "ga" }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Generally available since 9.4">
    Ensure your role has:
    - Minimum [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for these **Security** features:
      - `All` for **Attack discovery**
    - At least `Read` for **Rules**
    - At least `Read` for **Alerts**
    - The appropriate [index privileges](/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_index_privileges), based on what you want to do with Attack Discovery alerts:


    | Action                                                                                                                                                                                                                      | Indices                                                                                                                                                                                                                                                     | Elasticsearch privileges                                  |
    |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|
    | Read Attack Discovery alerts                                                                                                                                                                                                | - `.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>` | `read` and `view_index_metadata`                          |
    | Read and modify Attack Discovery alerts. This includes:- Generating discovery alerts manually- Generating discovery alerts using schedules- Sharing manually created alerts with other users- Updating a discovery's status | - `.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.alerts-security.attack.discovery.alerts-<space-id>`- `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`  | `read`, `view_index_metadata`, `write`, and `maintenance` |
  </applies-item>

  <applies-item title="{ "stack": "ga 9.3"}" applies-to="Elastic Stack: Generally available since 9.3">
    Ensure your role has:
    - `All` [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for the **Security > Attack discovery** Kibana feature and at least `Read` privileges for the **Security > Rules, Alerts, and Exceptions** Kibana feature.
      ![attack-discovery-rules-rbac](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/images/attack-discovery-rules-rbac.png "elasticsearch")
    - The appropriate [index privileges](/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_index_privileges), based on what you want to do with Attack Discovery alerts:


    | Action                                                                                                                                                                                                                      | Indices                                                                                                                                                                                                                                                     | Elasticsearch privileges                                  |
    |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|
    | Read Attack Discovery alerts                                                                                                                                                                                                | - `.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>` | `read` and `view_index_metadata`                          |
    | Read and modify Attack Discovery alerts. This includes:- Generating discovery alerts manually- Generating discovery alerts using schedules- Sharing manually created alerts with other users- Updating a discovery's status | - `.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.alerts-security.attack.discovery.alerts-<space-id>`- `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`  | `read`, `view_index_metadata`, `write`, and `maintenance` |
  </applies-item>

  <applies-item title="stack: ga 9.1-9.2" applies-to="Elastic Stack: Generally available from 9.1 to 9.2">
    Ensure your role has:
    - `All` [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for the **Security > Attack discovery** Kibana feature and at least `Read` privileges for the **Security > Rules, Alerts, and Exceptions** Kibana feature.
      ![attack-discovery-rbac](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/images/security-attck-disc-rbac.png "elasticsearch")
    - The appropriate [index privileges](/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_index_privileges), based on what you want to do with Attack Discovery alerts:


    | Action                                                                                                                                                                                                                      | Indices                                                                                                                                                                                                                                                     | Elasticsearch privileges                                  |
    |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|
    | Read Attack Discovery alerts                                                                                                                                                                                                | - `.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.alerts-security.attack.discovery.alerts-<space-id>` - `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>` | `read` and `view_index_metadata`                          |
    | Read and modify Attack Discovery alerts. This includes:- Generating discovery alerts manually- Generating discovery alerts using schedules- Sharing manually created alerts with other users- Updating a discovery's status | - `.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.alerts-security.attack.discovery.alerts-<space-id>`- `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`  | `read`, `view_index_metadata`, `write`, and `maintenance` |
  </applies-item>

  <applies-item title="stack: ga =9.0" applies-to="Elastic Stack: Generally available in 9.0">
    Ensure your role has `All` [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for the **Security > Attack discovery** Kibana feature.![attack-discovery-rbac](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/images/security-attck-disc-rbac.png "elasticsearch")
  </applies-item>
</applies-switch>