Run Attack Discovery
Pick the path that fits how you work and the Elastic Stack version you have. Every option uses the same analysis steps. Every option also requires a configured LLM connector.
| When to use this | Available in | Go to |
|---|---|---|
| Choose which alerts to analyze, then run Attack Discovery immediately or on a schedule. |
|
Run from the Attacks view |
| Include Attack Discovery as one step in a larger workflow. |
|
Run from a workflow |
| Ask Elastic Agent Builder to investigate in chat. |
|
Run from Elastic Agent Builder |
| Work from the standalone Attack Discovery experience |
|
Run from the Attack Discovery page |