--- title: "Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata" method: GET path: "/api/attack_discovery/generations/{execution_uuid}" tags: ["Security Attack discovery API"] --- # Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata `GET /api/attack_discovery/generations/{execution_uuid}` **Spaces method and path for this operation:**
get /s/{space_id}/api/attack_discovery/generations/{execution_uuid}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics. ## Path parameters - `execution_uuid` string, nonempty, required — A string that does not contain only whitespace characters. ## Query parameters - `enable_field_rendering` boolean - `with_replacements` boolean ## Response `200` Indicates a successful call. - object - `data` SecurityAttackDiscoveryAPIAttackDiscoveryApiAlert[], required — Array of Attack discoveries generated during this execution. - `alert_ids` string[], required — The alert IDs that the attack discovery is based on - `alert_rule_uuid` string — The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs) - `alert_start` string — The optional time the attack discovery alert was created - `alert_updated_at` string — The optional time the attack discovery alert was last updated - `alert_updated_by_user_id` string — The optional id of the user who last updated the attack discovery alert - `alert_updated_by_user_name` string — The optional username of the user who updated the attack discovery alert - `alert_workflow_status` string — The optional kibana.alert.workflow_status of this attack discovery - `alert_workflow_status_updated_at` string — The optional time the attack discovery alert workflow status was last updated - `assignees` string[] — The optional array of user-IDs who have been assigned the attack - `connector_id` string, required — The ID of the connector that generated the attack discovery - `connector_name` string, required — The (human readable) name of the connector that generated the attack discovery - `details_markdown` string, required — Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data. - `entity_summary_markdown` string — An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax - `generation_uuid` string, required — The generation ID of the run that created the attack discovery - `id` string, required — The unique ID of the attack discovery - `index` string — The concrete Elasticsearch index where this attack discovery is stored - `mitre_attack_tactics` string[] — An optional array of MITRE ATT&CK tactic for the attack discovery - `replacements` SecurityAttackDiscoveryAPIReplacements — Replacements object used to anonymize/deanonymize messages - `risk_score` integer — The optional, (but typically populated after generation) risk score of the alert - `summary_markdown` string, required — A markdown summary of attack discovery, using the same syntax - `tags` string[] — The optional array of tags assigned the attack - `timestamp` string, nonempty, required — A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters. - `title` string, required — A title for the attack discovery, in plain text - `user_id` string — The optional id of the user who generated the attack discovery - `user_name` string — The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules) - `users` SecurityAttackDiscoveryAPIUser[] — The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery. - `id` string — User id. - `name` string — User name. - `generation` SecurityAttackDiscoveryAPIAttackDiscoveryGeneration - `alerts_context_count` number — The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation - `connector_id` string, required — The connector id (event.dataset) for this generation - `connector_stats` object — Stats applicable to the connector for this generation - `average_successful_duration_nanoseconds` number — The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user - `successful_generations` number — The number of successful generations for the same connector id, for the current user - `conversation_id` string — Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran) - `discoveries` number, required — The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation - `duplicates_dropped_count` integer — The number of attack discoveries dropped as duplicates during the persist step - `end` string — When generation ended (max event.end) - `error_category` string — Structured error category from server classification (optional; absent for successful generations) - `execution_uuid` string, required — The unique identifier (kibana.alert.rule.execution.uuid) for the generation - `failed_workflow_id` string — Workflow ID that caused the failure (optional; absent for successful generations) - `generated_count` integer — The number of attack discoveries generated before deduplication and hallucination filtering - `hallucinations_filtered_count` integer — The number of attack discoveries filtered as hallucinations during the validation step - `loading_message` string — Generation loading message (kibana.alert.rule.execution.status) - `persisted_count` integer — The number of attack discoveries successfully persisted after deduplication and hallucination filtering - `reason` string — Reason for failed generations (event.reason) - `source_metadata` object, nullable — Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid) - `action_execution_uuid` string — The action execution UUID from the alerting framework - `rule_id` string — The ID of the alerting rule that triggered this generation - `rule_name` string — The name of the alerting rule that triggered this generation - `start` string, required — When generation started (min event.start) - `status` 'canceled' | 'dismissed' | 'failed' | 'started' | 'succeeded', required — The status of the attack discovery generation - `step_event_actions` string[] — Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status. - `workflow_executions` SecurityAttackDiscoveryAPIWorkflowExecutionsTracking — Workflow execution tracking for manual orchestration - `alertRetrieval` SecurityAttackDiscoveryAPIWorkflowExecutionReference[], nullable — Alert retrieval workflow executions (one per workflow invoked) - `workflowId` string, required — The workflow definition ID - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label) - `workflowRunId` string, required — The workflow execution ID - `gate` SecurityAttackDiscoveryAPIWorkflowExecutionReference[], nullable — Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers - `workflowId` string, required — The workflow definition ID - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label) - `workflowRunId` string, required — The workflow execution ID - `generation` SecurityAttackDiscoveryAPIWorkflowExecutionReference - `workflowId` string, required — The workflow definition ID - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label) - `workflowRunId` string, required — The workflow execution ID - `validation` SecurityAttackDiscoveryAPIWorkflowExecutionReference - `workflowId` string, required — The workflow definition ID - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label) - `workflowRunId` string, required — The workflow execution ID - `workflow_id` string — The workflow definition ID for deep linking - `workflow_run_id` string — The workflow execution ID for monitoring ## Other responses - `400` — Bad Request response. --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)