---
title: "Get Attack Discovery schedule by ID"
method: GET
path: "/api/attack_discovery/schedules/{id}"
tags: ["Security Attack discovery API"]
---

# Get Attack Discovery schedule by ID

`GET /api/attack_discovery/schedules/{id}`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.

## Path parameters

- `id` string, nonempty, required — A string that does not contain only whitespace characters.

## Response `200`

Successfully retrieved Attack Discovery schedule with complete configuration and metadata

- SecurityAttackDiscoveryAPIAttackDiscoveryApiSchedule — An Attack Discovery schedule
  - `actions` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleAction[], required — The Attack Discovery schedule actions
    - union
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleGeneralAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `alerts_filter` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionAlertsFilter
        - `frequency` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionFrequency — The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
          - `notify_when` 'onActiveAlert' | 'onThrottleInterval' | 'onActionGroupChange', required — The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`
          - `summary` boolean, required — Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          - `throttle` string, required — Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
        - `group` string, required — Groups actions by use cases. Use `default` for alert notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleSystemAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
  - `created_at` string, date-time, required — The date the schedule was created
  - `created_by` string, required — The name of the user that created the schedule
  - `enabled` boolean, required — Indicates whether the schedule is enabled
  - `id` string, required — UUID of Attack Discovery schedule
  - `last_execution` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleExecution — An Attack Discovery schedule execution information
    - `date` string, date-time, required — Date of the execution
    - `duration` number — Duration of the execution
    - `message` string
    - `status` 'ok' | 'active' | 'error' | 'unknown' | 'warning', required — An Attack Discovery schedule execution status
  - `name` string, required — The name of the schedule
  - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleParams, required — An Attack Discovery schedule params
    - `alerts_index_pattern` string, required — The index pattern to get alerts from
    - `api_config` object, required — LLM API configuration.
      - `actionTypeId` string, required — Action type ID
      - `connectorId` string, required — Connector ID
      - `defaultSystemPromptId` string — Default system prompt ID
      - `model` string — Model
      - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
      - `name` string, required — The name of the connector
    - `combined_filter` object
    - `end` string
    - `filters` unknown[] — The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
      - unknown
    - `query` SecurityAttackDiscoveryAPIQuery — An query condition to filter alerts
      - `language` string, required
      - `query` union, required
        - string
        - object
    - `size` number, required
    - `start` string
  - `schedule` SecurityAttackDiscoveryAPIIntervalApiSchedule, required
    - `interval` string, required — The schedule interval
  - `updated_at` string, date-time, required — The date the schedule was updated
  - `updated_by` string, required — The name of the user that updated the schedule

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)