---
title: Run Attack Discovery from the Attacks view
description: Configure, run, and schedule Attack Discovery from the Attacks view under Detections.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/run-from-attacks-page
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Preview in 9.4
---

# Run Attack Discovery from the Attacks view
From the **Attacks** view, configure which alerts to analyze, then start a manual or scheduled run. Discoveries appear in the same view next to their related alerts.

## Before you begin

To use the **Attacks** view, you need:
- The [Enable alerts and attacks alignment](/elastic/docs-content/pull/7557/solutions/security/get-started/configure-advanced-settings#enable-alerts-and-attacks-alignment) advanced setting turned on (only required for Elastic Stack 9.4).
- The [Attack Discovery Workflows](/elastic/docs-content/pull/7557/solutions/security/get-started/configure-advanced-settings#enable-attack-discovery-workflows) advanced setting turned on if you want the settings flyout with skill, query, and workflow retrieval.
- A role with the [index privileges](/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/grant-access#ad-index-privileges) required to generate and read discoveries, and these [Kibana privileges](/elastic/docs-content/pull/7557/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_kibana_privileges) at minimum:
  - **Security → Attack discovery**: `All`
- **Security → Rules and Exceptions**: `Read`
- **Security → Alerts**: `Read`


## Start a manual or scheduled run

<applies-switch>
  <applies-item title="{ "stack": "ga 9.5+", "serverless": {"security": "ga"} }" applies-to="Serverless Security projects: Generally available, Elastic Stack: Planned">
    1. Open the **Attacks** view at **Detections** → **Views** → **Attacks**.
    2. [Configure Attack Discovery settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page).
    3. Start Attack Discovery with a [manual run](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/manual-runs-from-attacks-page) or a [scheduled run](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/schedule-runs-from-attacks-page).
  </applies-item>

  <applies-item title="stack: preview =9.4" applies-to="Elastic Stack: Preview in 9.4">
    1. Open the **Attacks** view at **Detections** → **Views** → **Attacks**.
    2. [Configure which alerts to analyze](/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page#attacks-page-schedule-alert-selection) when you create or edit a schedule (classic schedule flyout controls).
    3. [Schedule runs](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/schedule-runs-from-attacks-page) from **Attacks**, or [manually run Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/manual-runs-from-attacks-page) from the Attack Discovery page.
  </applies-item>
</applies-switch>