---
title: Manage discoveries from the Attack Discovery page
description: This page describes how to change status, share, bulk-act on, and search saved discoveries directly from the Attack Discovery page. For a unified, alert-correlated...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-discoveries-from-attack-discovery-page
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available since 9.1
---

# Manage discoveries from the Attack Discovery page
This page describes how to change status, share, bulk-act on, and search saved discoveries directly from the **Attack Discovery** page. For a unified, alert-correlated view that also supports triage actions like assignment and tagging, use the [Attacks page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page) instead. For guidance on which page to use for your version, refer to [Manage saved discoveries](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-saved-discoveries).

## Change a discovery's status

You can set a discovery's status to indicate that it's under active investigation or that it's been resolved:

| Status       | Meaning                       |
|--------------|-------------------------------|
| Open         | Needs investigation (default) |
| Acknowledged | Under active investigation    |
| Closed       | Resolved                      |

Attacks on the [Attacks page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page) use this same status lifecycle.
To change a discovery's status, click **Take action**, then select **Mark as acknowledged** or **Mark as closed**. You can choose to change the status of only the discovery, or of both the discovery and the alerts associated with it.

## Share discoveries

By default, scheduled discoveries are shared with all users in a Kibana space.
Manually generated discoveries are private by default. To share them, change **Not shared** to **Shared** next to the discovery's name.
<note>
  Once a discovery is shared, its visibility cannot be changed.
</note>


## Take bulk actions

You can take bulk actions on multiple discoveries, such as bulk-changing their status or adding them to a case. To do this, select the checkboxes next to each discovery, then click **Selected *x* Attack discoveries** and choose the action you want to take.

## Search and filter saved discoveries

You can search and filter saved discoveries to help locate relevant findings.
- Use the search box to perform full-text searches across your generated discoveries.
- **Visibility**: Use this filter to, for example, show only [shared](#share-attack-discoveries) discoveries.
- **Status**: Filter discoveries by their [current status](#discovery-status).
- **Connector**: Filter discoveries by connector name. Connectors that are deleted after discoveries have been generated are shown with a **Deleted** tag.
- Time filter: Adjust the time filter to view discoveries generated within a specific timeframe.


## Incorporate discoveries with other workflows

There are several ways you can incorporate discoveries into your Elastic Security workflows:
- Click an entity’s name to open the entity details flyout and view more details that may be relevant to your investigation.
- Hover over an entity’s name to either add the entity to Timeline (![Add to timeline icon](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/images/security-icon-add-to-timeline.png "title")) or copy its field name and value to the clipboard (![Copy to clipboard icon](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/images/security-icon-copy.png "title")).
- Click **Take action**, then select **Add to new case** or **Add to existing case** to add a discovery to a [case](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/investigate/security-cases). This makes it easy to share the information with your team and other stakeholders.
- Click **Investigate in timeline** to explore the discovery in [Timeline](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/investigate/timeline).
- Click **View in AI Assistant** or **Add to chat** to attach the discovery to a conversation. You can then ask follow-up questions about the discovery or associated alerts.
- **Automate the triage end-to-end** with [Elastic Workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/workflows). The [AI-driven alert triage workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/workflows/use-cases/security/automate-security-operations/ai-driven-alert-triage) shows how to invoke an Agent Builder agent on each discovery, open a case populated with the analysis, isolate the affected host, and notify the SOC.

![Attack Discovery view in AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/images/security-add-discovery-to-assistant.gif)