Grant access to Attack Discovery

Attack Discovery requires specific Kibana feature privileges and, in most versions, index privileges on Attack Discovery alert indices. Some capabilities also require Workflows privileges.

After you grant the right access, choose how to run Attack Discovery.

Your role needs these Kibana privileges for the Security features in your version:

Attack discovery includes a Schedules sub-feature privilege:

Selecting All for Attack discovery includes Allow changes. To run Attack Discovery without managing schedules, turn on Customize sub-feature privileges and clear Allow changes.

Your role needs the appropriate index privileges based on what it must do with Attack Discovery alerts. Replace <space-id> with the Kibana space ID.

Your role needs the Elasticsearch privileges read and view_index_metadata on these indices:

• .alerts-security.attack.discovery.alerts-<space-id>
• .internal.alerts-security.attack.discovery.alerts-<space-id>
• .adhoc.alerts-security.attack.discovery.alerts-<space-id>
• .internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>

Your role needs the Elasticsearch privileges read, view_index_metadata, write, and maintenance on these indices to generate discoveries manually or with schedules, share manually created alerts with other users, and update a discovery's status:

• .alerts-security.attack.discovery.alerts-<space-id>
• .internal.alerts-security.attack.discovery.alerts-<space-id>
• .adhoc.alerts-security.attack.discovery.alerts-<space-id>
• .internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>

When you turn on Attack Discovery Workflows, your role also needs Analytics > Workflows privileges. Serverless roles include that access by default. On self-managed and Elastic Cloud Hosted deployments, add it to custom roles.

Granting All for Analytics → Workflows includes read and execute. For finer-grained access, use Workflows sub-feature privileges.