---
title: Troubleshoot a run with AI
description: Use AI troubleshooting from the Attacks view to diagnose failed Attack Discovery runs.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/troubleshoot-runs-from-attacks-page
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Planned
---

# Troubleshoot a run with AI
Use AI troubleshooting when an Attack Discovery run fails, is canceled or dismissed, or an analysis step fails. Troubleshooting only diagnoses problems. It never changes your configuration, schedules, or discoveries.

## Before you begin

To troubleshoot a run with AI, you need:
- The [Attack Discovery Workflows](/elastic/docs-content/pull/7557/solutions/security/get-started/configure-advanced-settings#enable-attack-discovery-workflows) advanced setting turned on.
- A run in [**Generations**](/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page#attacks-view-generations) to diagnose. Use this page when a run fails, is canceled or dismissed, or an analysis step fails.


## Open AI troubleshooting

1. Go to **Detections** → **Views** → **Attacks**.
2. Open the [**Generations**](/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page#attacks-view-generations) control center in the **Attacks** view header.
3. Select a failed, canceled, or dismissed run, or a run with a failed analysis step.
4. Start AI troubleshooting.

AI troubleshooting reviews the failed run (alert retrieval, generation, and validation), identifies what went wrong, and suggests a fix. After you identify the fix, update your [Attack Discovery settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page) if needed, then [start another manual run](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7557/solutions/security/ai/attack-discovery/manual-runs-from-attacks-page) or wait for the next scheduled run.

## Download a diagnostic report

From the same workflow execution details view, you can download a Markdown diagnostic report for the run. Use **Download diagnostic report** to save the file, or copy or inspect it first.
The report includes failure details, step timing, configuration context, and how the run was started. Share the downloaded file with Elastic Support when you open a case about a failed run.
The same diagnostic report is attached automatically when you start AI troubleshooting, so the agent has that context in the conversation.
<note>
  On the **Attack Discovery** page, after a run finishes, a details button on the success or failure banner opens the workflow execution details flyout if you have workflow-read privileges. From there, the same AI troubleshooting option and diagnostic report actions are available.
</note>