---
title: "Find Attack discoveries that match the search criteria"
method: GET
path: "/api/attack_discovery/_find"
tags: ["Security Attack discovery API"]
---

# Find Attack discoveries that match the search criteria

`GET /api/attack_discovery/_find`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_find</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.

## Query parameters

- `alert_ids` string[]
- `connector_names` string[]
- `enable_field_rendering` boolean
- `end` string
- `ids` string[]
- `include_unique_alert_ids` boolean
- `page` integer
- `per_page` integer
- `search` string
- `shared` boolean
- `include_all_authors` boolean
- `scheduled` boolean
- `sort_field` '@timestamp' — Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values.
- `sort_order` 'asc' | 'desc' — The order in which results are sorted.
- `start` string
- `status` string[]
- `with_replacements` boolean

## Response `200`

Indicates a successful call.

- object
  - `connector_names` string[], required — List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
  - `data` SecurityAttackDiscoveryAPIAttackDiscoveryApiAlert[], required — Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema.
    - `alert_ids` string[], required — The alert IDs that the attack discovery is based on
    - `alert_rule_uuid` string — The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
    - `alert_start` string — The optional time the attack discovery alert was created
    - `alert_updated_at` string — The optional time the attack discovery alert was last updated
    - `alert_updated_by_user_id` string — The optional id of the user who last updated the attack discovery alert
    - `alert_updated_by_user_name` string — The optional username of the user who updated the attack discovery alert
    - `alert_workflow_status` string — The optional kibana.alert.workflow_status of this attack discovery
    - `alert_workflow_status_updated_at` string — The optional time the attack discovery alert workflow status was last updated
    - `assignees` string[] — The optional array of user-IDs who have been assigned the attack
    - `connector_id` string, required — The ID of the connector that generated the attack discovery
    - `connector_name` string, required — The (human readable) name of the connector that generated the attack discovery
    - `details_markdown` string, required — Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
    - `entity_summary_markdown` string — An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
    - `generation_uuid` string, required — The generation ID of the run that created the attack discovery
    - `id` string, required — The unique ID of the attack discovery
    - `index` string — The concrete Elasticsearch index where this attack discovery is stored
    - `mitre_attack_tactics` string[] — An optional array of MITRE ATT&CK tactic for the attack discovery
    - `replacements` SecurityAttackDiscoveryAPIReplacements — Replacements object used to anonymize/deanonymize messages
    - `risk_score` integer — The optional, (but typically populated after generation) risk score of the alert
    - `summary_markdown` string, required — A markdown summary of attack discovery, using the same syntax
    - `tags` string[] — The optional array of tags assigned the attack
    - `timestamp` string, nonempty, required — A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
    - `title` string, required — A title for the attack discovery, in plain text
    - `user_id` string — The optional id of the user who generated the attack discovery
    - `user_name` string — The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
    - `users` SecurityAttackDiscoveryAPIUser[] — The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.
      - `id` string — User id.
      - `name` string — User name.
  - `page` integer, required — Current page number of the paginated result set.
  - `per_page` integer, required — Number of items requested per page.
  - `total` integer, required — Total number of Attack discoveries matching the query (across all pages).
  - `unique_alert_ids` string[] — List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
  - `unique_alert_ids_count` integer, required — Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)