Manage saved discoveries

Attack discoveries are automatically saved each time they're generated. Once saved, discoveries remain available for later review, reporting, and tracking over time. This allows you to revisit discoveries to monitor trends, maintain audit trails, and support investigations as your environment evolves.

Which page you use to manage saved discoveries depends on what you're trying to do.

The Attack Discovery page is your primary place to generate, save, and triage discoveries.

If you'd rather split generation and triage into separate flows, you can instead:

• Go to Attack Discovery to run LLM analysis on demand and create new attack discoveries.
• Go to Attacks for day-to-day triage of all attacks (manual and scheduled), and to manage their investigation lifecycle.

• Learn about Attack Discovery
• Investigate threats with Timeline
• Manage security cases
• Automate attack triage with Elastic Workflows