---
title: Schedule runs from the Attacks view
description: Create and manage recurring Attack Discovery schedules from the Attacks view under Detections.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/schedule-runs-from-attacks-page
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Preview in 9.4
---

# Schedule runs from the Attacks view
Create a schedule so Attack Discovery runs automatically at intervals you choose. From the **Attacks** view, define how often analysis runs, which alerts to include, and optionally notify your team when discoveries are found.
<applies-switch>
  <applies-item title="{ "stack": "ga 9.5+", "serverless": {"security": "ga"} }" applies-to="Serverless Security projects: Generally available, Elastic Stack: Planned">
    <important>
      After you turn on [Attack Discovery Workflows](/elastic/docs-content/pull/7588/solutions/security/get-started/configure-advanced-settings#enable-attack-discovery-workflows), existing schedules keep their previous configuration until you edit and save them. Each scheduled run also opens a new Elastic Agent Builder conversation you can view later from **Workflow execution details**.
    </important>
    To create a schedule:
    1. Go to **Detections** → **Views** → **Attacks**, then select **Schedule** → **Create new schedule**.
    2. Name the schedule and choose an LLM connector for generation.
    3. [Configure which alerts to analyze](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page). For example, keep skill retrieval on and add an ES|QL query to focus on high-severity alerts.
    4. Set how often the schedule runs, such as every 24 hours.
    5. (Optional) Add notification [connectors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/deploy-manage/manage-connectors) and actions, then select **Create & enable schedule**. Supported notification connectors include Slack, ServiceNow, Jira, PagerDuty, Cases, Email, and Webhook.
  </applies-item>

  <applies-item title="stack: preview =9.4" applies-to="Elastic Stack: Preview in 9.4">
    To create a schedule:
    1. Go to **Detections** → **Views** → **Attacks**, then select **Schedule** → **Create new schedule**.
    2. Name the schedule and choose an LLM connector for generation.
    3. [Configure which alerts to analyze](/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page#attacks-page-schedule-alert-selection).
    4. Set how often the schedule runs, such as every 24 hours.
    5. (Optional) Add notification [connectors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7588/deploy-manage/manage-connectors) and actions, then select **Create & enable schedule**. For example, send a Slack or email notification when discoveries are found.
  </applies-item>
</applies-switch>

After creating a schedule, you can edit, enable, disable, or delete it. To change several at once, select them in the table and use **Bulk actions**. Schedule management requires the [**Schedules → Allow changes**](/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/grant-access#ad-schedules-privilege) privilege. To manage schedules programmatically, use the [Attack discovery API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-security-attack-discovery-api).
Scheduled discoveries show a calendar icon. For how to recognize scheduled versus manually generated attacks, refer to [Recognize manually generated and scheduled attacks](/elastic/docs-content/pull/7588/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page#manually-generated-attacks).