v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB

Security Attack discovery API

Generate attack discoveries from alerts

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/attack_discovery/_generate</span></div>

Refer to Spaces for more information.

Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.

post/api/attack_discovery/_generate

Request body

alertsIndexPatternstring required

The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default

connectorNamestring

endstring

filterobject

An Elasticsearch-style query DSL object used to filter alerts. For example:

  "filter": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "term": {
                  "user.name": { "value": "james" }
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
} ```

modelstring

replacementsSecurityAttackDiscoveryAPIReplacements

Replacements object used to anonymize/deanonymize messages

sizenumber required

startstring

subAction'invokeAI' | 'invokeStream' required

Example request

{
  "anonymizationFields": [
    {
      "allowed": true,
      "createdAt": "2023-10-31T12:00:00Z",
      "createdBy": "user1",
      "field": "url.domain",
      "id": "I am a string",
      "namespace": "default",
      "timestamp": "2023-10-31T12:00:00Z",
      "updatedAt": "2023-10-31T12:00:00Z",
      "updatedBy": "user1"
    }
  ],
  "apiConfig": {
    "actionTypeId": "actionType456",
    "connectorId": "connector123",
    "defaultSystemPromptId": "systemPrompt001",
    "model": "gpt-4",
    "provider": "OpenAI"
  }
}

Response

Indicates a successful call.

execution_uuidstring nonempty required

A string that does not contain only whitespace characters.

Example response

{
  "execution_uuid": "I am a string"
}