Configure Attack Discovery settings from the Attacks view
You can configure which alerts Attack Discovery retrieves, and how discoveries are created and checked. Use the following table to find the section that matches your setup.
| Your setup | Available in | Go to |
|---|---|---|
| Attack Discovery Workflows is turned on. Configure alert retrieval methods, generation, and validation for manual runs and schedules. |
|
Configure alert retrieval, generation, and validation |
| Attack Discovery Workflows is turned off. Configure alerts for manual runs with the query bar, time filter, and alerts slider. |
|
Configure alerts for manual runs with the query bar and alerts slider |
| Attack Discovery Workflows is turned off, or not available in your version. Configure alerts for scheduled runs with the query bar, time filter, and alerts slider. |
|
Configure alerts for scheduled runs with the query bar and alerts slider |
When Attack Discovery Workflows is turned on, use Attack discovery settings to control which alerts Attack Discovery analyzes, which LLM creates the discoveries, and how those discoveries are checked before they're saved as attacks. Your choices apply to the manual runs you start from the Attacks view and are saved for you on this browser. Schedules can use different settings.
To open the Attack discovery settings flyout, select Settings next to Run on the Attacks page.
Under Alert retrieval method, choose one or more ways to collect the alerts Attack Discovery analyzes. At least one method must stay enabled.
| Toggle | Default | What it does | When to use it |
|---|---|---|---|
| Attack discovery skill retrieves alerts | On | The skill retrieves and curates additional relevant alerts on top of any alerts collected by the other retrieval methods. | Keep this on for broad coverage. Use it alone for general monitoring, or with a query or workflow when you want the skill to still add related alerts. |
| ES|QL or custom query | Off | Retrieves alerts that match a query you define. | Turn this on when you already know which alerts matter, for example high-severity alerts or a specific rule set. With the toggle on, Edit with AI appears next to the query editor so you can refine the query through chat in Elastic Agent Builder. |
| Alert retrieval workflows | Off | Runs one or more user-authored workflows to retrieve and enrich alerts. | Turn this on when your team maintains reusable retrieval or enrichment logic in Workflows. Select which workflows to run. Select the info icon next to the toggle for a copy-pasteable example. For building custom retrieval workflows, refer to Run Attack Discovery from a workflow. |
Common setups:
- Skill only (default): Broad alert selection without writing a query.
- Skill plus ES|QL or workflows: Focus the run with a query or workflow, and still let the skill add related alerts.
- ES|QL or workflows only: Analyze only the alerts your query or workflows return. Turn off Attack discovery skill retrieves alerts for this.
After you choose your retrieval methods, continue with generation and validation.
When you enable more than one Alert retrieval method toggle, Attack Discovery combines their results before analysis:
- ES|QL or custom query and Alert retrieval workflows each add matching alerts.
- If Attack discovery skill retrieves alerts is also on, the skill can add related alerts on top of that result.
- If the same alert appears from more than one method, Attack Discovery keeps one copy.
The Attack discovery skill retrieves alerts toggle only controls whether the skill adds extra related alerts. For manual, scheduled, and workflow-triggered runs, the skill still reviews the collected alerts during generation.
Manual, scheduled, and workflow-triggered runs open a new Elastic Agent Builder conversation you can view later. Open it from Workflow execution details with Open conversation. Runs started from Elastic Agent Builder chat stay in the current conversation.
Under Generation, select the Connector for generating attack discoveries. You must select a connector before you can save alert retrieval settings or start a manual run. Schedules can use their own connector when you create or edit them.
- Use a model that performs well for Attack Discovery. Refer to the Large language model performance matrix for recommended models.
- If you don't already have a connector, add one from the connector dropdown. Refer to Connectors.
If you want to call Attack Discovery from automation instead, select View example to open the managed Security - Attack discovery - Run example workflow. Refer to Run Attack Discovery from a workflow for more information.
Next, choose a validation workflow.
Under Validation, choose what happens to discoveries after generation and before they're saved as attacks.
For most setups, keep Security - Attack discovery - Default validation. That workflow:
- Removes discoveries that reference alert IDs that were not part of the analysis (hallucinated IDs).
- Deduplicates the remaining discoveries.
- Saves the results as attacks.
Choose a different workflow only when you need extra steps before save, such as enrichment, stricter filtering, or org-specific checks. You can:
- Select View example to open Security - Attack discovery - Custom validation example, which shows how to run the default checks and then change discovery fields before saving.
- Select Create a new workflow to build your own validation workflow.
If you create a custom validation workflow, it must save the discoveries you want to keep. Otherwise they never appear as attacks. For details, refer to Create custom retrieval and validation workflows.
Select Save to keep the settings, or Save and run to save and start a manual run immediately. You can also start a manual run later with Run, or create a schedule.
When Attack Discovery Workflows is turned off, use Attack discovery settings to choose which alerts to analyze. You set a query and time range, then choose how many alerts to send. Your choices apply to the manual runs you start from the Attacks view and are saved for you on this browser. Schedules can use different settings.
To open the Attack discovery settings flyout, select Settings next to Run on the Attacks page, then:
- Select a Connector for generating attack discoveries.
- Optionally add a KQL query and set the time range.
- Use Set number of alerts to analyze to choose how many alerts to send. Send fewer alerts if the model's context window is small, or more if it is larger.
- Review the selection under Alert summary or Alerts preview.
- Select Save, or Save and run to start analysis immediately.
Sending more alerts than your chosen LLM can handle might result in an error.
When Attack Discovery Workflows is turned off, or not available in your version, set which alerts each schedule analyzes when you create or edit it. You choose a query, a time range, and how many alerts to send. Sending more alerts than your chosen LLM can handle might result in an error.
Refer to Schedule runs from the Attacks view to finish creating or editing the schedule.