openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Attack discovery API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.
  name: Security Attack discovery API
  x-displayName: Security Attack discovery
paths:
  /api/attack_discovery/_bulk:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_bulk</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.'
      operationId: PostAttackDiscoveryBulk
      requestBody:
        content:
          application/json:
            examples:
              PostAttackDiscoveryBulkRequestBodyExample:
                summary: Acknowledge two Attack discoveries in bulk.
                value:
                  update:
                    enable_field_rendering: false
                    ids:
                    - c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                    - 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
                    kibana_alert_workflow_status: acknowledged
                    with_replacements: true
            schema:
              type: object
              properties:
                update:
                  description: Configuration object containing all parameters for the bulk update operation
                  type: object
                  properties:
                    enable_field_rendering:
                      default: false
                      description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
                      example: false
                      type: boolean
                    ids:
                      description: Array of Attack Discovery IDs to update
                      example:
                      - c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                      - 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
                      items:
                        type: string
                      type: array
                    kibana_alert_workflow_status:
                      description: When provided, update the kibana.alert.workflow_status of the attack discovery alerts
                      enum:
                      - open
                      - acknowledged
                      - closed
                      example: acknowledged
                      type: string
                    visibility:
                      description: When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field
                      enum:
                      - not_shared
                      - shared
                      example: shared
                      type: string
                    with_replacements:
                      default: true
                      description: When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`.
                      example: true
                      type: boolean
                  required:
                  - ids
              required:
              - update
        description: Bulk update parameters for Attack discoveries
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                PostAttackDiscoveryBulkResponse200Example:
                  summary: A successful bulk update response containing the modified Attack discoveries.
                  value:
                    data:
                    - alert_ids:
                      - alert-abc-1
                      alert_workflow_status: acknowledged
                      connector_id: gen-ai-connector
                      connector_name: OpenAI GPT-4
                      details_markdown: '- **Host** `workstation-01` showed credential access patterns consistent with mimikatz.'
                      generation_uuid: 550e8400-e29b-41d4-a716-446655440000
                      id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                      summary_markdown: A user account was compromised using mimikatz to dump credentials.
                      timestamp: '2024-01-15T10:00:00.000Z'
                      title: Credential theft via mimikatz
              schema:
                type: object
                properties:
                  data:
                    description: Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    type: array
                required:
                - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PostAttackDiscoveryBulkResponse400Example:
                  summary: Bad Request error returned when the bulk update payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong with the bulk update request
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
                required:
                - status_code
                - error
                - message
          description: Bad Request response.
      summary: Bulk update Attack discoveries
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_bulk' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data-raw '{\n   \"update\": {\n     \"ids\": [\n       \"c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f\",\n       \"5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7\"\n     ],\n     \"kibana_alert_workflow_status\": \"acknowledged\"\n   }\n }'\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.'
      operationId: AttackDiscoveryFind
      parameters:
      - description: Filter results to Attack discoveries that include any of the provided alert IDs
        in: query
        name: alert_ids
        required: false
        schema:
          items:
            type: string
          type: array
      - description: Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from `connector_id` values used to generate Attack discoveries.
        in: query
        name: connector_names
        required: false
        schema:
          items:
            type: string
          type: array
      - description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
        example: false
        in: query
        name: enable_field_rendering
        required: false
        schema:
          default: false
          type: boolean
      - description: End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
        example: now
        in: query
        name: end
        required: false
        schema:
          type: string
      - description: Filter results to the Attack discoveries with the specified IDs
        in: query
        name: ids
        required: false
        schema:
          items:
            type: string
          type: array
      - description: If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries
        example: false
        in: query
        name: include_unique_alert_ids
        required: false
        schema:
          type: boolean
      - description: Page number to return (used for pagination). Defaults to 1.
        example: 1
        in: query
        name: page
        required: false
        schema:
          default: 1
          minimum: 1
          type: integer
      - description: Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
        example: 10
        in: query
        name: per_page
        required: false
        schema:
          default: 10
          minimum: 1
          type: integer
      - description: Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
        example: ''
        in: query
        name: search
        required: false
        schema:
          type: string
      - description: Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user.
        in: query
        name: shared
        required: false
        schema:
          type: boolean
      - description: Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.
        in: query
        name: scheduled
        required: false
        schema:
          type: boolean
      - description: Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.
        example: '@timestamp'
        in: query
        name: sort_field
        required: false
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryFindSortField'
          default: '@timestamp'
      - description: Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.
        example: desc
        in: query
        name: sort_order
        required: false
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_SortOrder'
          default: desc
      - description: Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
        example: now-24h
        in: query
        name: start
        required: false
        schema:
          type: string
      - description: Filter by alert workflow status. Provide one or more of the allowed workflow states.
        example:
        - open
        - acknowledged
        in: query
        name: status
        required: false
        schema:
          items:
            enum:
            - acknowledged
            - closed
            - open
            type: string
          type: array
      - description: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.
        example: true
        in: query
        name: with_replacements
        required: false
        schema:
          default: true
          type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                AttackDiscoveryFindResponse200Example:
                  summary: Paginated list of Attack discoveries matching the search criteria.
                  value:
                    connector_names:
                    - GPT-5 Chat
                    data:
                    - connector_name: GPT-5 Chat
                      id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                      title: Suspicious process execution on host-01
                    page: 1
                    per_page: 10
                    total: 1
                    unique_alert_ids_count: 0
              schema:
                type: object
                properties:
                  connector_names:
                    description: List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
                    items:
                      type: string
                    type: array
                  data:
                    description: Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    type: array
                  page:
                    description: Current page number of the paginated result set.
                    type: integer
                  per_page:
                    description: Number of items requested per page.
                    type: integer
                  total:
                    description: Total number of Attack discoveries matching the query (across all pages).
                    type: integer
                  unique_alert_ids:
                    description: List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
                    items:
                      type: string
                    type: array
                  unique_alert_ids_count:
                    description: Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
                    type: integer
                required:
                - connector_names
                - data
                - page
                - per_page
                - total
                - unique_alert_ids_count
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                AttackDiscoveryFindResponse400Example:
                  summary: Bad Request error returned when find query parameters are invalid.
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message
                    example: Invalid request payload.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Find Attack discoveries that match the search criteria
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/_find?end=now&include_unique_alert_ids=false&page=1&per_page=10&search=&sort_field=%40timestamp&sort_order=desc&start=now-24h&status=open&status=acknowledged' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/_generate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_generate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.'
      operationId: PostAttackDiscoveryGenerate
      requestBody:
        content:
          application/json:
            examples:
              PostAttackDiscoveryGenerateRequestBodyExample:
                summary: Generate Attack discoveries from alerts in the last 24 hours.
                value:
                  alertsIndexPattern: .alerts-security.alerts-default
                  anonymizationFields:
                  - allowed: true
                    anonymized: true
                    field: host.name
                  - allowed: true
                    anonymized: true
                    field: user.name
                  - allowed: true
                    anonymized: false
                    field: process.name
                  apiConfig:
                    actionTypeId: .gen-ai
                    connectorId: 12345678-1234-1234-1234-123456789012
                  connectorName: GPT-5 Chat
                  end: now
                  replacements: {}
                  size: 100
                  start: now-24h
                  subAction: invokeAI
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenerationConfig'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerateResponse200Example:
                  summary: Generation started; use the returned execution UUID to track progress.
                  value:
                    execution_uuid: edd26039-0990-4d9f-9829-2a1fcacb77b5
              schema:
                type: object
                properties:
                  execution_uuid:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier for the attack discovery generation process. Use this UUID to track the generation progress and retrieve results via the find endpoint.
                    example: edd26039-0990-4d9f-9829-2a1fcacb77b5
                required:
                - execution_uuid
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerateResponse400Example:
                  summary: Bad Request error returned when the generate payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
                required:
                - status_code
                - error
                - message
          description: Bad Request response.
      summary: Generate attack discoveries from alerts
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_generate' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n    \"alertsIndexPattern\": \".alerts-security.alerts-default\",\n    \"anonymizationFields\": [\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"@timestamp\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"aKiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.feature\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"saiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.data\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"sqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.entropy\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"s6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.extension\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"tKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.metrics\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"taiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.operation\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"tqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.path\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"t6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.score\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"uKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.version\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"uaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"_id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"Z6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"agent.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"aaiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"cloud.availability_zone\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"aqiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"cloud.provider\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"a6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"cloud.region\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"bKiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"destination.ip\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"baiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"dns.question.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"bqiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"dns.question.type\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"b6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.category\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"cKiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.dataset\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"caiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.module\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"cqiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.outcome\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"c6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.Ext.original.path\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"dKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.hash.sha256\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"daiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"dqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.path\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"d6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"group.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"eKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"group.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"eaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.asset.criticality\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"eqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.name\",\n        \"allowed\": true,\n        \"anonymized\": true,\n        \"namespace\": \"default\",\n        \"id\": \"e6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.os.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"fKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.os.version\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"faiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.risk.calculated_level\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"fqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.risk.calculated_score_norm\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"f6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.original_time\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"gKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.risk_score\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"gaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.description\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"gqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"g6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.references\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"hKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.framework\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"haiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.tactic.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"hqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.tactic.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"h6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.tactic.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"iKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"iaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"iqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"i6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.subtechnique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"jKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.subtechnique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"jaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.subtechnique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"jqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.severity\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"j6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.workflow_status\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"kKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"message\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"kaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"network.protocol\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"kqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.bytes_compressed_present\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"nKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.malware_signature.all_names\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"naiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.malware_signature.primary.matches\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"nqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.malware_signature.primary.signature.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"n6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.token.integrity_level_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"oKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.args\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"k6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.exists\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"lKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.signing_id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"laiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.status\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"lqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.subject_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"l6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.trusted\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"mKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.command_line\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"maiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.executable\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"mqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.exit_code\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"m6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.hash.md5\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"oaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.hash.sha1\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"oqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.hash.sha256\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"o6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"pKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.args\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"paiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.args_count\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"pqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.exists\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"p6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.status\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"qKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.subject_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"qaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.trusted\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"qqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.command_line\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"q6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.executable\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"rKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"raiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.pe.original_file_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"rqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.pid\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"r6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.working_directory\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"sKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"rule.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"uqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"rule.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"u6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"source.ip\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"vKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.framework\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"vaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.tactic.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"vqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.tactic.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"v6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.tactic.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"wKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"waiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"wqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"w6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.subtechnique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"xKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.subtechnique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"xaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.subtechnique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"xqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.asset.criticality\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"x6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.domain\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"yKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.name\",\n        \"allowed\": true,\n        \"anonymized\": true,\n        \"namespace\": \"default\",\n        \"id\": \"yaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.risk.calculated_level\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"yqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.risk.calculated_score_norm\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"y6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.target.name\",\n        \"allowed\": true,\n        \"anonymized\": true,\n        \"namespace\": \"default\",\n        \"id\": \"zKiJW5gB4U27o8XO8oLg\"\n      }\n    ],\n    \"replacements\": {},\n    \"size\": 100,\n    \"subAction\": \"invokeAI\",\n    \"apiConfig\": {\n      \"connectorId\": \"12345678-1234-1234-1234-123456789012\",\n      \"actionTypeId\": \".gen-ai\"\n    },\n    \"connectorName\": \"GPT-5 Chat\",\n    \"end\": \"now\",\n    \"start\": \"now-24h\"\n  }'\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/generations:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.'
      operationId: GetAttackDiscoveryGenerations
      parameters:
      - description: End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
        example: now
        in: query
        name: end
        required: false
        schema:
          type: string
      - description: The maximum number of generations to retrieve
        example: 50
        in: query
        name: size
        required: false
        schema:
          default: 50
          minimum: 1
          type: number
      - description: Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
        example: now-24h
        in: query
        name: start
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationsResponse200Example:
                  summary: Latest Attack Discovery generation metadata for the current user.
                  value:
                    generations:
                    - alerts_context_count: 75
                      connector_id: chatGpt5_0ChatAzure
                      discoveries: 3
                      end: '2025-09-29T06:42:44.810Z'
                      execution_uuid: 46b218d5-535d-4329-be56-d0f6af6986b7
                      loading_message: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                      start: '2025-09-29T06:42:08.962Z'
                      status: succeeded
              schema:
                type: object
                properties:
                  generations:
                    description: List of Attack Discovery generations
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGeneration'
                    type: array
                required:
                - generations
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationsResponse400Example:
                  summary: Bad Request error returned when the size parameter is invalid.
                  value:
                    error: Bad Request
                    message: Invalid size parameter. Must be a positive number.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message
                    example: Invalid size parameter. Must be a positive number.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Get the latest Attack Discovery generations metadata for the current user
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/generations?size=50&start=now-24h&end=now' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/generations/{execution_uuid}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations/{execution_uuid}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.'
      operationId: GetAttackDiscoveryGeneration
      parameters:
      - description: The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.
        example: 2e13f386-46cf-4d65-9e2b-68609e132ba5
        in: path
        name: execution_uuid
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      - description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
        example: false
        in: query
        name: enable_field_rendering
        required: false
        schema:
          default: false
          type: boolean
      - description: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.
        example: true
        in: query
        name: with_replacements
        required: false
        schema:
          default: true
          type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationResponse200Example:
                  summary: Single Attack Discovery generation with its discoveries and metadata.
                  value:
                    data:
                    - id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                      title: Suspicious process execution on host-01
                    generation:
                      alerts_context_count: 50
                      discoveries: 1
                      end: '2025-09-29T06:42:44.810Z'
                      execution_uuid: 2e13f386-46cf-4d65-9e2b-68609e132ba5
                      start: '2025-09-29T06:42:08.962Z'
                      status: succeeded
              schema:
                type: object
                properties:
                  data:
                    description: Array of Attack discoveries generated during this execution.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    type: array
                  generation:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGeneration'
                    description: Optional metadata about the attack discovery generation process, metadata including execution status and statistics. This metadata may not be available for all generations.
                required:
                - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationResponse400Example:
                  summary: Bad Request error returned when the get-generation request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong with the request
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
                required:
                - status_code
                - error
                - message
          description: Bad Request response.
      summary: Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/generations/2e13f386-46cf-4d65-9e2b-68609e132ba5' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/generations/{execution_uuid}/_dismiss:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations/{execution_uuid}/_dismiss</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Dismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI. This sets the generation''s status to "dismissed" and affects how the generation appears in subsequent queries.'
      operationId: PostAttackDiscoveryGenerationsDismiss
      parameters:
      - description: The unique identifier for the Attack Discovery generation execution. This UUID is returned when an Attack Discovery generation is created and can be found in generation responses.
        example: 46b218d5-535d-4329-be56-d0f6af6986b7
        in: path
        name: execution_uuid
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerationsDismissResponse200Example:
                  summary: Successfully dismissed an Attack Discovery generation.
                  value:
                    alerts_context_count: 75
                    connector_id: chatGpt5_0ChatAzure
                    discoveries: 3
                    end: '2025-09-29T06:42:44.810Z'
                    execution_uuid: 46b218d5-535d-4329-be56-d0f6af6986b7
                    loading_message: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                    start: '2025-09-29T06:42:08.962Z'
                    status: dismissed
              schema:
                type: object
                properties:
                  alerts_context_count:
                    description: The number of alerts that were sent as context to the LLM for this generation.
                    example: 75
                    type: number
                  connector_id:
                    description: The unique identifier of the connector used to generate the attack discoveries.
                    example: chatGpt5_0ChatAzure
                    type: string
                  connector_stats:
                    description: Statistical information about the connector's performance for this user, providing insights into usage patterns and success rates.
                    type: object
                    properties:
                      average_successful_duration_nanoseconds:
                        description: The average duration in nanoseconds for successful generations using this connector by the current user.
                        example: 47958500000
                        type: number
                      successful_generations:
                        description: The total number of Attack discoveries successfully created for this generation
                        example: 2
                        type: number
                  discoveries:
                    description: The number of attack discoveries that were generated during this execution.
                    example: 3
                    type: number
                  end:
                    description: The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven't finished.
                    example: '2025-09-29T06:42:44.810Z'
                    type: string
                  execution_uuid:
                    description: The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls.
                    example: 46b218d5-535d-4329-be56-d0f6af6986b7
                    type: string
                  loading_message:
                    description: A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing.
                    example: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                    type: string
                  reason:
                    description: Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process.
                    example: Connection timeout to AI service
                    type: string
                  start:
                    description: The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis.
                    example: '2025-09-29T06:42:08.962Z'
                    type: string
                  status:
                    description: The current status of the attack discovery generation. After dismissing, this will be set to "dismissed".
                    enum:
                    - canceled
                    - dismissed
                    - failed
                    - started
                    - succeeded
                    example: dismissed
                    type: string
                required:
                - connector_id
                - discoveries
                - execution_uuid
                - loading_message
                - start
                - status
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerationsDismissResponse400Example:
                  summary: Bad Request error returned when the dismiss request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type or category
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong with the request.
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code indicating the type of client error
                    example: 400
                    type: number
                required:
                - status_code
                - error
                - message
          description: Bad Request response.
      summary: Dismiss an Attack Discovery generation
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/generations/46b218d5-535d-4329-be56-d0f6af6986b7/_dismiss' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/schedules:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.'
      operationId: CreateAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            examples:
              CreateAttackDiscoverySchedulesRequestBodyExample:
                summary: Create a daily Attack Discovery schedule that runs every 24 hours.
                value:
                  actions: []
                  enabled: true
                  name: Daily Security Analysis
                  params:
                    alerts_index_pattern: .alerts-security.alerts-default
                    api_config:
                      actionTypeId: bedrock
                      connectorId: my-bedrock-connector
                      name: Claude 3.5 Sonnet
                    end: now
                    size: 100
                    start: now-24h
                  schedule:
                    interval: 24h
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps'
        description: Attack Discovery schedule configuration including name, parameters, schedule interval, and actions
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateAttackDiscoverySchedulesResponse200Example:
                  summary: A newly created Attack Discovery schedule.
                  value:
                    actions: []
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    name: Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 100
                      start: now-24h
                    schedule:
                      interval: 24h
                    updated_at: '2023-10-31T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
          description: The Attack Discovery schedule was successfully created.
        '400':
          content:
            application/json:
              examples:
                CreateAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the create schedule payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Create Attack Discovery schedule
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Create an Attack Discovery schedule
        lang: curl
        source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n   \"name\": \"Daily Security Analysis\",\n   \"enabled\": true,\n   \"params\": {\n     \"alerts_index_pattern\": \".alerts-security.alerts-default\",\n     \"api_config\": {\n       \"actionTypeId\": \"bedrock\",\n       \"connectorId\": \"my-bedrock-connector\",\n       \"name\": \"Claude 3.5 Sonnet\"\n     },\n     \"size\": 100,\n     \"start\": \"now-24h\",\n     \"end\": \"now\"\n   },\n   \"schedule\": {\n     \"interval\": \"24h\"\n   },\n   \"actions\": [\n      {\n         \"action_type_id\": \".cases\",\n         \"id\": \"system-connector-.cases\",\n         \"params\": {\n           \"subAction\": \"run\",\n           \"subActionParams\": {\n             \"timeWindow\": \"7d\",\n             \"reopenClosedCases\": false,\n             \"groupingBy\": [],\n             \"templateId\": null\n           }\n         },\n         \"uuid\": \"12345678-1234-1234-1234-123456789012\"\n       }\n   ]\n }'\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/schedules/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.'
      operationId: FindAttackDiscoverySchedules
      parameters:
      - description: Page number to return (used for pagination). Defaults to 1.
        example: 1
        in: query
        name: page
        required: false
        schema:
          type: number
      - description: Number of Attack Discovery schedules to return per page (used for pagination). Defaults to 10.
        example: 10
        in: query
        name: per_page
        required: false
        schema:
          type: number
      - description: Field used to sort results. Common fields include 'name', 'created_at', 'updated_at', and 'enabled'.
        example: name
        in: query
        name: sort_field
        required: false
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      - description: Sort order direction. Use 'asc' for ascending or 'desc' for descending. Defaults to 'asc'.
        example: asc
        in: query
        name: sort_direction
        required: false
        schema:
          enum:
          - asc
          - desc
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                FindAttackDiscoverySchedulesResponse200Example:
                  summary: Paginated list of Attack Discovery schedules matching the search criteria.
                  value:
                    data:
                    - actions: []
                      created_at: '2023-10-31T10:00:00.000Z'
                      created_by: elastic
                      enabled: true
                      id: 12345678-1234-1234-1234-123456789012
                      name: Daily Security Analysis
                      params:
                        alerts_index_pattern: .alerts-security.alerts-default
                        api_config:
                          actionTypeId: bedrock
                          connectorId: my-bedrock-connector
                          name: Claude 3.5 Sonnet
                        end: now
                        size: 100
                        start: now-24h
                      schedule:
                        interval: 24h
                      updated_at: '2023-10-31T10:00:00.000Z'
                      updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    description: Array of matched Attack Discovery schedule objects.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
                    type: array
                  page:
                    description: Current page number of the paginated result set.
                    type: number
                  per_page:
                    description: Number of items requested per page.
                    type: number
                  total:
                    description: Total number of Attack Discovery schedules matching the query (across all pages).
                    type: number
                required:
                - page
                - per_page
                - total
                - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                FindAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when find-schedules query parameters are invalid.
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message
                    example: Invalid request payload.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Find Attack Discovery schedules that match the search criteria
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Example request
        lang: curl
        source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/schedules/_find' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/schedules/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Permanently deletes an Attack Discovery schedule and all associated configuration.'
      operationId: DeleteAttackDiscoverySchedules
      parameters:
      - description: The unique identifier (UUID) of the Attack Discovery schedule to delete. This ID is returned when creating a schedule and can be found in schedule listings.
        example: 12345678-1234-1234-1234-123456789012
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after deleting an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
              schema:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier of the deleted Attack Discovery schedule
                required:
                - id
          description: Successfully deleted Attack Discovery schedule, returning the ID of the deleted schedule for confirmation
        '400':
          content:
            application/json:
              examples:
                DeleteAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the delete schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Delete Attack Discovery schedule
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Delete an Attack Discovery schedule
        lang: curl
        source: "curl \\\n --request DELETE 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.'
      operationId: GetAttackDiscoverySchedules
      parameters:
      - description: The unique identifier (UUID) of the Attack Discovery schedule to retrieve. This ID is returned when creating a schedule and can be found in schedule listings.
        example: 12345678-1234-1234-1234-123456789012
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                GetAttackDiscoverySchedulesResponse200Example:
                  summary: An Attack Discovery schedule retrieved by ID, including last execution metadata.
                  value:
                    actions: []
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    last_execution:
                      date: '2023-10-31T10:00:00.000Z'
                      last_duration: 45.2
                      status: ok
                    name: Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 100
                      start: now-24h
                    schedule:
                      interval: 24h
                    updated_at: '2023-10-31T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
          description: Successfully retrieved Attack Discovery schedule with complete configuration and metadata
        '400':
          content:
            application/json:
              examples:
                GetAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the get-schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Get Attack Discovery schedule by ID
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Get an Attack Discovery schedule by ID
        lang: curl
        source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.'
      operationId: UpdateAttackDiscoverySchedules
      parameters:
      - description: The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.
        example: 12345678-1234-1234-1234-123456789012
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      requestBody:
        content:
          application/json:
            examples:
              UpdateAttackDiscoverySchedulesRequestBodyExample:
                summary: Update an Attack Discovery schedule to run every 12 hours over a 48-hour window.
                value:
                  actions: []
                  name: Updated Daily Security Analysis
                  params:
                    alerts_index_pattern: .alerts-security.alerts-default
                    api_config:
                      actionTypeId: bedrock
                      connectorId: my-bedrock-connector
                      name: Claude 3.5 Sonnet
                    end: now
                    size: 200
                    start: now-48h
                  schedule:
                    interval: 12h
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps'
        description: Updated Attack Discovery schedule configuration. All fields are required as this replaces the entire schedule configuration.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateAttackDiscoverySchedulesResponse200Example:
                  summary: An Attack Discovery schedule after being updated.
                  value:
                    actions: []
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    name: Updated Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 200
                      start: now-48h
                    schedule:
                      interval: 12h
                    updated_at: '2023-10-31T12:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
          description: Successfully updated Attack Discovery schedule with the new configuration and metadata
        '400':
          content:
            application/json:
              examples:
                UpdateAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the update schedule payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Update Attack Discovery schedule
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Update an Attack Discovery schedule
        lang: curl
        source: "curl \\\n --request PUT 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n   \"name\": \"Updated Daily Security Analysis\",\n   \"params\": {\n     \"alerts_index_pattern\": \".alerts-security.alerts-default\",\n     \"api_config\": {\n       \"actionTypeId\": \"bedrock\",\n       \"connectorId\": \"my-bedrock-connector\",\n       \"name\": \"Claude 3.5 Sonnet\"\n     },\n     \"size\": 200,\n     \"start\": \"now-48h\",\n     \"end\": \"now\"\n   },\n   \"schedule\": {\n     \"interval\": \"12h\"\n   },\n   \"actions\": []\n }'\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/schedules/{id}/_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}/_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Disables an Attack Discovery schedule, preventing it from running according to its configured interval. The schedule configuration is preserved and can be re-enabled later. Any currently running executions will complete, but no new executions will be started.'
      operationId: DisableAttackDiscoverySchedules
      parameters:
      - description: The unique identifier (UUID) of the Attack Discovery schedule to disable. This ID is returned when creating a schedule and can be found in schedule listings.
        example: 12345678-1234-1234-1234-123456789012
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                DisableAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after disabling an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
              schema:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier of the disabled Attack Discovery schedule
                required:
                - id
          description: Successfully disabled Attack Discovery schedule, returning the schedule ID for confirmation
        '400':
          content:
            application/json:
              examples:
                DisableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the disable schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Disable Attack Discovery schedule
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Disable an Attack Discovery schedule
        lang: curl
        source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_disable' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/attack_discovery/schedules/{id}/_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}/_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Enables a previously disabled Attack Discovery schedule, allowing it to run according to its configured interval. Once enabled, the schedule will begin executing at the next scheduled time based on its interval configuration.'
      operationId: EnableAttackDiscoverySchedules
      parameters:
      - description: The unique identifier (UUID) of the Attack Discovery schedule to enable. This ID is returned when creating a schedule and can be found in schedule listings.
        example: 12345678-1234-1234-1234-123456789012
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                EnableAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after enabling an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
              schema:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier of the enabled Attack Discovery schedule
                required:
                - id
          description: Successfully enabled Attack Discovery schedule, returning the schedule ID for confirmation
        '400':
          content:
            application/json:
              examples:
                EnableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the enable schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Enable Attack Discovery schedule
      tags:
      - Security Attack discovery API
      x-codeSamples:
      - label: Enable an Attack Discovery schedule
        lang: curl
        source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_enable' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Attack_discovery_API_AttackDiscoveryGenericError:
      description: Error response for Attack discovery schedule operations when the request is rejected. Uses `status_code` (snake_case), `error`, and `message` to match the implementation.
      type: object
      properties:
        error:
          description: Error type
          example: Bad Request
          type: string
        message:
          description: Human-readable error message describing what went wrong
          example: Invalid request parameters.
          type: string
        status_code:
          description: HTTP status code
          example: 400
          type: number
    Security_Attack_discovery_API_AttackDiscoveryGenerationConfig:
      type: object
      properties:
        alertsIndexPattern:
          description: 'The (space specific) index pattern that contains the alerts to use as

            context for the attack discovery.

            Example: .alerts-security.alerts-default

            '
          type: string
        anonymizationFields:
          description: The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the `/api/security_ai_assistant/anonymization_fields/_find` API (for a specific Kibana space) to provide this value.
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AnonymizationFieldResponse'
          type: array
        apiConfig:
          $ref: '#/components/schemas/Security_Attack_discovery_API_ApiConfig'
          description: LLM API configuration.
        connectorName:
          type: string
        end:
          type: string
        filter:
          additionalProperties: true
          description: "An Elasticsearch-style query DSL object used to filter alerts. For example:\n```json {\n  \"filter\": {\n    \"bool\": {\n      \"must\": [],\n      \"filter\": [\n        {\n          \"bool\": {\n            \"should\": [\n              {\n                \"term\": {\n                  \"user.name\": { \"value\": \"james\" }\n                }\n              }\n            ],\n            \"minimum_should_match\": 1\n          }\n        }\n      ],\n      \"should\": [],\n      \"must_not\": []\n    }\n  }\n} ```"
          type: object
        model:
          type: string
        replacements:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Replacements'
        size:
          type: number
        start:
          type: string
        subAction:
          enum:
          - invokeAI
          - invokeStream
          type: string
      required:
      - apiConfig
      - alertsIndexPattern
      - anonymizationFields
      - size
      - subAction
    Security_Attack_discovery_API_NonEmptyString:
      description: A string that does not contain only whitespace characters.
      example: I am a string
      format: nonempty
      minLength: 1
      type: string
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams:
      description: An Attack Discovery schedule params
      type: object
      properties:
        alerts_index_pattern:
          description: The index pattern to get alerts from
          type: string
        api_config:
          allOf:
          - $ref: '#/components/schemas/Security_Attack_discovery_API_ApiConfig'
          - type: object
            properties:
              name:
                description: The name of the connector
                type: string
            required:
            - name
          description: LLM API configuration.
        combined_filter:
          additionalProperties: true
          type: object
        end:
          type: string
        filters:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Filters'
        query:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Query'
        size:
          type: number
        start:
          type: string
      required:
      - alerts_index_pattern
      - api_config
      - size
    Security_Attack_discovery_API_ApiConfig:
      type: object
      properties:
        actionTypeId:
          description: Action type ID
          example: actionType456
          type: string
        connectorId:
          description: Connector ID
          example: connector123
          type: string
        defaultSystemPromptId:
          description: Default system prompt ID
          example: systemPrompt001
          type: string
        model:
          description: Model
          example: gpt-4
          type: string
        provider:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Provider'
          description: Provider
          example: OpenAI
      required:
      - connectorId
      - actionTypeId
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter:
      additionalProperties: true
      type: object
    Security_Attack_discovery_API_AttackDiscoveryApiSchedule:
      description: An Attack Discovery schedule
      type: object
      properties:
        actions:
          description: The Attack Discovery schedule actions
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction'
          type: array
        created_at:
          description: The date the schedule was created
          format: date-time
          type: string
        created_by:
          description: The name of the user that created the schedule
          type: string
        enabled:
          description: Indicates whether the schedule is enabled
          type: boolean
        id:
          description: UUID of Attack Discovery schedule
          type: string
        last_execution:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution'
          description: The Attack Discovery schedule last execution summary
        name:
          description: The name of the schedule
          type: string
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams'
          description: The Attack Discovery schedule configuration parameters
        schedule:
          $ref: '#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule'
          description: The Attack Discovery schedule interval
        updated_at:
          description: The date the schedule was updated
          format: date-time
          type: string
        updated_by:
          description: The name of the user that updated the schedule
          type: string
      required:
      - id
      - name
      - created_by
      - updated_by
      - created_at
      - updated_at
      - enabled
      - params
      - schedule
      - actions
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId:
      description: The connector ID.
      type: string
    Security_Attack_discovery_API_Filters:
      description: The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
      items: {}
      type: array
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps:
      description: An Attack Discovery schedule update properties
      type: object
      properties:
        actions:
          description: The Attack Discovery schedule actions
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction'
          type: array
        name:
          description: The name of the schedule
          type: string
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams'
          description: The Attack Discovery schedule configuration parameters
        schedule:
          $ref: '#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule'
          description: The Attack Discovery schedule interval
      required:
      - name
      - params
      - schedule
      - actions
    Security_Attack_discovery_API_AttackDiscoveryApiAlert:
      description: An attack discovery that's also an alert (Public API with snake_case)
      type: object
      properties:
        alert_ids:
          description: The alert IDs that the attack discovery is based on
          items:
            type: string
          type: array
        alert_rule_uuid:
          description: The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
          type: string
        alert_start:
          description: The optional time the attack discovery alert was created
          type: string
        alert_updated_at:
          description: The optional time the attack discovery alert was last updated
          type: string
        alert_updated_by_user_id:
          description: The optional id of the user who last updated the attack discovery alert
          type: string
        alert_updated_by_user_name:
          description: The optional username of the user who updated the attack discovery alert
          type: string
        alert_workflow_status:
          description: The optional kibana.alert.workflow_status of this attack discovery
          type: string
        alert_workflow_status_updated_at:
          description: The optional time the attack discovery alert workflow status was last updated
          type: string
        assignees:
          description: The optional array of user-IDs who have been assigned the attack
          items:
            type: string
          type: array
        connector_id:
          description: The ID of the connector that generated the attack discovery
          type: string
        connector_name:
          description: The (human readable) name of the connector that generated the attack discovery
          type: string
        details_markdown:
          description: Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
          type: string
        entity_summary_markdown:
          description: An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
          type: string
        generation_uuid:
          description: The generation ID of the run that created the attack discovery
          type: string
        id:
          description: The unique ID of the attack discovery
          type: string
        index:
          description: The concrete Elasticsearch index where this attack discovery is stored
          type: string
        mitre_attack_tactics:
          description: An optional array of MITRE ATT&CK tactic for the attack discovery
          items:
            type: string
          type: array
        replacements:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Replacements'
          description: Key-value pairs that are used to replace placeholders in the markdown fields
        risk_score:
          description: The optional, (but typically populated after generation) risk score of the alert
          type: integer
        summary_markdown:
          description: A markdown summary of attack discovery, using the same syntax
          type: string
        tags:
          description: The optional array of tags assigned the attack
          items:
            type: string
          type: array
        timestamp:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyTimestamp'
          description: The time the attack discovery was generated
        title:
          description: A title for the attack discovery, in plain text
          type: string
        user_id:
          description: The optional id of the user who generated the attack discovery
          type: string
        user_name:
          description: The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
          type: string
        users:
          description: The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_User'
          type: array
      required:
      - alert_ids
      - connector_id
      - connector_name
      - details_markdown
      - generation_uuid
      - id
      - summary_markdown
      - timestamp
      - title
    Security_Attack_discovery_API_NonEmptyTimestamp:
      description: A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
      example: '2023-10-31T12:00:00Z'
      format: nonempty
      minLength: 1
      type: string
    Security_Attack_discovery_API_Provider:
      description: Provider
      enum:
      - OpenAI
      - Azure OpenAI
      - Other
      example: OpenAI
      type: string
    Security_Attack_discovery_API_Replacements:
      additionalProperties:
        type: string
      description: Replacements object used to anonymize/deanonymize messages
      type: object
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen:
      description: 'The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`,  or `onThrottleInterval`'
      enum:
      - onActiveAlert
      - onThrottleInterval
      - onActionGroupChange
      type: string
    Security_Attack_discovery_API_AttackDiscoveryGeneration:
      type: object
      properties:
        alerts_context_count:
          description: The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
          type: number
        connector_id:
          description: The connector id (event.dataset) for this generation
          type: string
        connector_stats:
          description: Stats applicable to the connector for this generation
          type: object
          properties:
            average_successful_duration_nanoseconds:
              description: The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
              type: number
            successful_generations:
              description: The number of successful generations for the same connector id, for the current user
              type: number
        discoveries:
          description: The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
          type: number
        end:
          description: When generation ended (max event.end)
          type: string
        execution_uuid:
          description: The unique identifier (kibana.alert.rule.execution.uuid) for the generation
          type: string
        loading_message:
          description: Generation loading message (kibana.alert.rule.execution.status)
          type: string
        reason:
          description: Reason for failed generations (event.reason)
          type: string
        start:
          description: When generation started (min event.start)
          type: string
        status:
          description: The status of the attack discovery generation
          enum:
          - canceled
          - dismissed
          - failed
          - started
          - succeeded
          type: string
      required:
      - connector_id
      - discoveries
      - execution_uuid
      - loading_message
      - start
      - status
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution:
      description: An Attack Discovery schedule execution information
      type: object
      properties:
        date:
          description: Date of the execution
          format: date-time
          type: string
        duration:
          description: Duration of the execution
          type: number
        message:
          type: string
        status:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus'
          description: Status of the execution
      required:
      - date
      - status
      - last_duration
    Security_Attack_discovery_API_AttackDiscoveryFindSortField:
      description: Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values.
      enum:
      - '@timestamp'
      type: string
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle:
      description: Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
      example: 1h
      pattern: ^[1-9]\d*[smhd]$
      type: string
    Security_Attack_discovery_API_User:
      description: Could be any string, not necessarily a UUID.
      type: object
      properties:
        id:
          description: User id.
          example: user123
          type: string
        name:
          description: User name.
          example: John Doe
          type: string
    Security_Attack_discovery_API_IntervalApiSchedule:
      type: object
      properties:
        interval:
          description: The schedule interval
          type: string
      required:
      - interval
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction:
      type: object
      properties:
        action_type_id:
          description: The action type used for sending notifications.
          type: string
        id:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId'
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams'
        uuid:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      required:
      - action_type_id
      - id
      - params
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction:
      type: object
      properties:
        action_type_id:
          description: The action type used for sending notifications.
          type: string
        alerts_filter:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter'
        frequency:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency'
        group:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup'
        id:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId'
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams'
        uuid:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      required:
      - action_type_id
      - group
      - id
      - params
    Security_Attack_discovery_API_Query:
      description: An query condition to filter alerts
      type: object
      properties:
        language:
          type: string
        query:
          oneOf:
          - type: string
          - additionalProperties: true
            type: object
      required:
      - query
      - language
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps:
      description: An Attack Discovery schedule create properties
      type: object
      properties:
        actions:
          description: The Attack Discovery schedule actions
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction'
          type: array
        enabled:
          description: Indicates whether the schedule is enabled
          type: boolean
        name:
          description: The name of the schedule
          type: string
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams'
          description: The Attack Discovery schedule configuration parameters
        schedule:
          $ref: '#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule'
          description: The Attack Discovery schedule interval
      required:
      - name
      - params
      - schedule
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction:
      oneOf:
      - $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction'
      - $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup:
      description: Groups actions by use cases. Use `default` for alert notifications.
      type: string
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus:
      description: An Attack Discovery schedule execution status
      enum:
      - ok
      - active
      - error
      - unknown
      - warning
      type: string
    Security_Attack_discovery_API_AnonymizationFieldResponse:
      type: object
      properties:
        allowed:
          description: Whether this field is allowed to be sent to the model.
          example: true
          type: boolean
        anonymized:
          description: Whether this field should be anonymized.
          example: false
          type: boolean
        createdAt:
          description: Timestamp of when the anonymization field was created.
          example: '2023-10-31T12:00:00Z'
          type: string
        createdBy:
          description: Username of the person who created the anonymization field.
          example: user1
          type: string
        field:
          description: Name of the anonymization field.
          example: url.domain
          type: string
        id:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          description: The ID of the anonymization field.
        namespace:
          description: Kibana space in which this anonymization field exists.
          example: default
          type: string
        timestamp:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyTimestamp'
          description: Timestamp when the anonymization field was initially created.
        updatedAt:
          description: Timestamp of the last update.
          example: '2023-10-31T12:00:00Z'
          type: string
        updatedBy:
          description: Username of the person who last updated the field.
          example: user1
          type: string
      required:
      - id
      - field
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams:
      additionalProperties: true
      description: Object containing the allowed connector fields, which varies according to the connector type.
      type: object
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency:
      description: The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
      type: object
      properties:
        notify_when:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen'
        summary:
          description: Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          type: boolean
        throttle:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle'
          nullable: true
      required:
      - summary
      - notify_when
      - throttle
    Security_Attack_discovery_API_SortOrder:
      description: The order in which results are sorted.
      enum:
      - asc
      - desc
      example: asc
      type: string
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"