---
title: Manually run Attack Discovery from the Attacks view
description: Manually run Attack Discovery from the Attacks view, or from the Attack Discovery page in 9.4.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/manual-runs-from-attacks-page
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Preview in 9.4
---

# Manually run Attack Discovery from the Attacks view
Manually run Attack Discovery when you want to analyze the current alert selection right away, for example after you change settings or during an active investigation. Discoveries from a manual run appear in the **Attacks** table alongside scheduled discoveries.
<applies-switch>
  <applies-item title="{ "stack": "ga 9.5+", "serverless": {"security": "ga"} }" applies-to="Serverless Security projects: Generally available, Elastic Stack: Planned">
    To manually run Attack Discovery from the **Attacks** view:
    1. Go to **Detections** → **Views** → **Attacks**.
    2. [Configure Attack Discovery settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page) in **Settings** next to **Run**, and confirm an LLM connector is selected. You can start analysis from the flyout with **Save and run**, or close the flyout and continue with the next step.
    3. Select **Run**. A notification confirms that generation has started.
    Analysis can take from a few seconds to several minutes, depending on the number of alerts and the model. Open **Generations** in the **Attacks** view header to watch progress. When the run finishes, refresh the **Attacks** view to see new discoveries in the same table as scheduled discoveries (labeled as manually generated). Select **Run** again anytime to start another analysis with the current alert selection.
    <note>
      Attack Discovery uses the same data anonymization settings as [Elastic AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/ai-assistant). Configure which alert fields are sent to the LLM, and which are obfuscated, in the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
    </note>
    After the run finishes, [manage discoveries from the Attacks view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page). If the run fails, [troubleshoot it with AI](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/troubleshoot-runs-from-attacks-page). To run Attack Discovery automatically at intervals, [schedule a run](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/schedule-runs-from-attacks-page).
  </applies-item>

  <applies-item title="stack: preview =9.4" applies-to="Elastic Stack: Preview in 9.4">
    Start manual runs from the [Attack Discovery page](/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/run-from-attack-discovery-page#attack-discovery-generate-discoveries). Use the **Attacks** page for triage, or [schedule a run](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/schedule-runs-from-attacks-page) for recurring analysis.
  </applies-item>
</applies-switch>