Run Attack Discovery from Elastic Agent Builder

When you chat with the Elastic AI Agent, the attack-discovery-generator skill can run Attack Discovery as part of the answer. The skill gathers and cross-checks evidence from other Security skills, then runs the same analysis used by other Attack Discovery triggers and returns a report in the conversation.

For example prompts, refer to Security use cases for Elastic Agent Builder. For automation without a person in the loop, use Run Attack Discovery from a workflow.

To run Attack Discovery from Elastic Agent Builder, you need:

• The Attack Discovery Workflows advanced setting turned on.
• A role with the index privileges required to generate and read discoveries, and these Kibana privileges at minimum:
  • Security → Attack discovery: All
  • Security → Rules and Exceptions: Read
  • Security → Alerts: Read
  • Analytics → Workflows: read and execute (see Grant Workflows privileges for Attack Discovery)

Skills can activate automatically from your prompt, when you invoke one with a slash command, or when you attach matching context. These steps assume the agent selects attack-discovery-generator from your prompt.

1. Open Elastic Agent Builder.
2. Ask the agent to investigate: Investigate lateral movement involving host-12 over the last 24 hours.
3. Review the report in the conversation. It can include summary statistics, a narrative for each discovery, supporting evidence, an attack-flow graph, and a link to the saved discovery.
4. Open the saved discovery, or continue triage in the Attacks view.

More example prompts are in Attack Discovery generation.

The attack-discovery-generator skill first gathers and cross-checks evidence. It can pull from other skills such as threat hunting, entity analytics, alert analysis, threat intelligence, and the knowledge base. Then it runs the same analysis steps used by every other Attack Discovery trigger.

Runs started from chat stay in the current conversation. Manual, scheduled, and workflow-triggered runs open a separate Elastic Agent Builder conversation you can view later.

Related skills on the Attacks view do not replace attack-discovery-generator:

• attack-discovery-alert-retrieval-builder powers Edit with AI in Attack Discovery settings.
• attack-discovery-workflow-troubleshooting powers AI troubleshooting for failed runs.

If the skill finds a gap, such as an important event in a confirmed attack that had no matching alert, it proposes a detection rule in the conversation and waits for your approval before creating anything. Reply in chat to approve (for example, create the rule) or to refine the proposal first. The agent uses the detection-rule-edit skill only after you approve.

The same gap-closure flow is available from the Elastic Agent Builder conversation that manual and scheduled runs open. From Workflow execution details, select Open conversation.

To check an existing run without starting a new Attack Discovery analysis, ask about it by execution ID, for example: What's the status of Attack Discovery run <execution-id>?