---
title: Grant access to Attack Discovery
description: Required Kibana, index, and workflow privileges for Attack Discovery by version.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/grant-access
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Grant access to Attack Discovery
Attack Discovery requires specific Kibana feature privileges and, in most versions, index privileges on Attack Discovery alert indices. Some capabilities also require Workflows privileges.
After you grant the right access, [choose how to run Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/run-attack-discovery).

## Kibana feature privileges

Your role needs these [Kibana privileges](/elastic/docs-content/pull/7588/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_kibana_privileges) for the **Security** features in your version:

| Available in                                                                                                                                 | Privileges                                                                                                      |
|----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
| <applies-to>Elastic Stack: Generally available since 9.4</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | `All` for **Attack discovery**, and at least `Read` for **Rules and Exceptions** and **Alerts**                 |
| <applies-to>Elastic Stack: Generally available from 9.1 to 9.3</applies-to>                                                                  | `All` for **Security > Attack discovery**, and at least `Read` for **Security > Rules, Alerts, and Exceptions** |
| <applies-to>Elastic Stack: Generally available in 9.0</applies-to>                                                                           | `All` for **Security > Attack discovery**                                                                       |


### Schedules sub-feature privilege

<applies-to>
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available since 9.1
</applies-to>

**Attack discovery** includes a **Schedules** sub-feature privilege:

| UI label                      | What it controls                                                    |
|-------------------------------|---------------------------------------------------------------------|
| **Schedules → Allow changes** | Create, edit, enable, disable, or delete Attack discovery schedules |

Selecting `All` for **Attack discovery** includes **Allow changes**. To run Attack Discovery without managing schedules, turn on **Customize sub-feature privileges** and clear **Allow changes**.

## Index privileges

<applies-to>
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available since 9.1
</applies-to>

Your role needs the appropriate [index privileges](/elastic/docs-content/pull/7588/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_index_privileges) based on what it must do with Attack Discovery alerts. Replace `<space-id>` with the Kibana space ID.

### Read Attack Discovery alerts

Your role needs the Elasticsearch privileges `read` and `view_index_metadata` on these indices:
- `.alerts-security.attack.discovery.alerts-<space-id>`
- `.internal.alerts-security.attack.discovery.alerts-<space-id>`
- `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`
- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`


### Read and modify Attack Discovery alerts

Your role needs the Elasticsearch privileges `read`, `view_index_metadata`, `write`, and `maintenance` on these indices to generate discoveries manually or with schedules, share manually created alerts with other users, and update a discovery's status:
- `.alerts-security.attack.discovery.alerts-<space-id>`
- `.internal.alerts-security.attack.discovery.alerts-<space-id>`
- `.adhoc.alerts-security.attack.discovery.alerts-<space-id>`
- `.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>`


## Grant Workflows privileges for Attack Discovery

<applies-to>
  - Serverless Security projects: Generally available
  - Elastic Stack: Planned
</applies-to>

When you turn on [Attack Discovery Workflows](/elastic/docs-content/pull/7588/solutions/security/get-started/configure-advanced-settings#enable-attack-discovery-workflows), your role also needs **Analytics > Workflows** privileges. Serverless roles include that access by default. On self-managed and Elastic Cloud Hosted deployments, add it to custom roles.

| Attack Discovery action                                             | Workflows privilege needed                                                                                            |
|---------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| Monitor runs in **Generations** and open workflow execution details | `read` for **Analytics → Workflows**                                                                                  |
| Generate discoveries (manual or scheduled)                          | `read` and `execute` for **Analytics → Workflows**                                                                    |
| Create, edit, or enable schedules                                   | `read` and `execute` for **Analytics → Workflows**, plus [**Schedules** → **Allow changes**](#ad-schedules-privilege) |
| Deactivate or delete schedules                                      | [**Schedules** → **Allow changes**](#ad-schedules-privilege) only                                                     |

Granting `All` for **Analytics → Workflows** includes `read` and `execute`. For finer-grained access, use Workflows [sub-feature privileges](/elastic/docs-content/pull/7588/explore-analyze/workflows/get-started/setup#workflows-role-access).