---
title: Attack Discovery
description: Attack Discovery uses large language models (LLMs) to analyze alerts and identify potential attacks. Each discovery groups related alerts into an attack...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7596/solutions/security/ai/attack-discovery
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Attack Discovery
Attack Discovery uses large language models (LLMs) to analyze alerts and identify potential attacks. Each discovery groups related alerts into an attack narrative. It shows which users and hosts are involved, how alerts map to the MITRE ATT&CK matrix, and which threat actor might be responsible. Use discoveries to prioritize investigation and shorten mean time to respond.
You can start a run from the UI (manual or scheduled), from an automated workflow, or from an Elastic Agent Builder conversation. All methods use the same analysis steps.
For a demo, refer to the following video (click to view).
[![Attack Discovery video](https://play.vidyard.com/eT92arEbpRddmSM4JeyzdX.jpg)](https://videos.elastic.co/watch/eT92arEbpRddmSM4JeyzdX?)

## Information included in each discovery

Each discovery includes the following information describing the potential threat, generated by the connected LLM:
1. A descriptive title and a summary of the potential threat.
2. The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to.
3. The implicated entities (users and hosts), and what suspicious activity was observed for each.

![Attack Discovery detail view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7596/solutions/images/security-attck-disc-example-disc.png)


### View discovery details in the flyout

<applies-to>
  - Serverless Security projects: Generally available
  - Elastic Stack: Planned
</applies-to>

When you open an attack from the [Attacks view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7596/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page), its details appear in a flyout. The **Overview** tab organizes the information above into the following sections:
- **AI Summary**: The discovery's title and the LLM-generated summary of the potential threat.
- **Visualizations**: An expandable **Attack Chain** diagram that maps the attack to [MITRE ATT&CK](https://attack.mitre.org/) tactics. Expand or collapse this section to show or hide the diagram; your choice persists across sessions.
- **Insights**: The related entities (users and hosts) and correlated alerts involved in the attack.


## Get started with Attack Discovery

Choose how to start a run from the **Attacks** view, a workflow, Elastic Agent Builder, or the **Attack Discovery** page in [Run Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7596/solutions/security/ai/attack-discovery/run-attack-discovery).