Run from the Attacks page

The Attacks page pairs with the Attack Discovery page, which is where you manually generate new discoveries using large language models (LLMs):

• Go to Attack Discovery to run LLM analysis on demand and create new attack discoveries.
• Go to Attacks for day-to-day triage of all attacks (manual and scheduled), and to manage their investigation lifecycle.

This page describes how to run Attack Discovery directly from the Attacks page by scheduling recurring runs. The scheduling flow is the same as on the Attack Discovery page, and schedules you create on either page appear on both. To trigger a one-off, on-demand run instead, use the Attack Discovery page. For guidance on which page to use for your version, refer to Manage saved discoveries.

The Attacks page requires the same privileges as Attack Discovery. Refer to Role-based access control (RBAC) for Attack Discovery for details.

When you create a schedule, you can customize which alerts Attack Discovery analyzes using the KQL query bar, time filter, and alerts slider in the Attack discovery schedule flyout. Note that sending more alerts than your chosen LLM can handle may result in an error.

You can define recurring schedules (for example, daily or weekly) to automatically generate attack discoveries without needing manual runs. For example, you can generate discoveries every 24 hours and send a Slack notification to your SecOps channel if discoveries are found. Notifications are sent using configured connectors, such as Slack or email, and you can customize the notification content to tailor alert context to your needs.

To create a new schedule:

1. In the top-right corner, select Schedule.
2. In the Attack discovery schedule flyout, select Create new schedule.
3. Enter a name for the new schedule.
4. Select the LLM connector to use for generating discoveries, or add a new one.
5. Configure which alerts to analyze.
6. Define the schedule's frequency (for example, every 24 hours).
7. Optionally, select the connectors to use for receiving notifications, and define their actions.
8. Click Create & enable schedule.

After creating new schedules, you can view their status, modify them, or delete them from the Attack discovery schedule flyout. You can also act on multiple schedules at once:

1. In the schedule table, select the checkbox next to each schedule you want to act on.

2. Select Bulk actions, then choose one of the following:

   • Enable to enable the selected schedules.
   • Disable to disable the selected schedules.
   • Delete to delete the selected schedules. You'll be asked to confirm before the schedules are removed.

Bulk actions apply only to the schedules you've explicitly selected in the table.

To manage schedules programmatically, use the Attack discovery API, which includes endpoints for bulk-enabling, bulk-disabling, and bulk-deleting schedules.