---
title: "Update Attack Discovery schedule"
method: PUT
path: "/api/attack_discovery/schedules/{id}"
tags: ["Security Attack discovery API"]
---

# Update Attack Discovery schedule

`PUT /api/attack_discovery/schedules/{id}`

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.

## Path parameters

- `id` string, nonempty, required — A string that does not contain only whitespace characters.

## Request body

- SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleUpdateProps — An Attack Discovery schedule update properties
  - `actions` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleAction[], required — The Attack Discovery schedule actions
    - union
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleGeneralAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `alerts_filter` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionAlertsFilter
        - `frequency` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionFrequency — The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
          - `notify_when` 'onActiveAlert' | 'onThrottleInterval' | 'onActionGroupChange', required — The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`
          - `summary` boolean, required — Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          - `throttle` string, required — Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
        - `group` string, required — Groups actions by use cases. Use `default` for alert notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleSystemAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
  - `name` string, required — The name of the schedule
  - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleParams, required — An Attack Discovery schedule params
    - `alerts_index_pattern` string, required — The index pattern to get alerts from
    - `api_config` object, required — LLM API configuration.
      - `actionTypeId` string, required — Action type ID
      - `connectorId` string, required — Connector ID
      - `defaultSystemPromptId` string — Default system prompt ID
      - `model` string — Model
      - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
      - `name` string, required — The name of the connector
    - `combined_filter` object
    - `end` string
    - `filters` unknown[] — The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
      - unknown
    - `query` SecurityAttackDiscoveryAPIQuery — An query condition to filter alerts
      - `language` string, required
      - `query` union, required
        - string
        - object
    - `size` number, required
    - `start` string
  - `schedule` SecurityAttackDiscoveryAPIIntervalApiSchedule, required
    - `interval` string, required — The schedule interval

## Response `200`

Successfully updated Attack Discovery schedule with the new configuration and metadata

- SecurityAttackDiscoveryAPIAttackDiscoveryApiSchedule — An Attack Discovery schedule
  - `actions` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleAction[], required — The Attack Discovery schedule actions
    - union
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleGeneralAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `alerts_filter` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionAlertsFilter
        - `frequency` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionFrequency — The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
          - `notify_when` 'onActiveAlert' | 'onThrottleInterval' | 'onActionGroupChange', required — The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`
          - `summary` boolean, required — Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          - `throttle` string, required — Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
        - `group` string, required — Groups actions by use cases. Use `default` for alert notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleSystemAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
  - `created_at` string, date-time, required — The date the schedule was created
  - `created_by` string, required — The name of the user that created the schedule
  - `enabled` boolean, required — Indicates whether the schedule is enabled
  - `id` string, required — UUID of Attack Discovery schedule
  - `last_execution` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleExecution — An Attack Discovery schedule execution information
    - `date` string, date-time, required — Date of the execution
    - `duration` number — Duration of the execution
    - `message` string
    - `status` 'ok' | 'active' | 'error' | 'unknown' | 'warning', required — An Attack Discovery schedule execution status
  - `name` string, required — The name of the schedule
  - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleParams, required — An Attack Discovery schedule params
    - `alerts_index_pattern` string, required — The index pattern to get alerts from
    - `api_config` object, required — LLM API configuration.
      - `actionTypeId` string, required — Action type ID
      - `connectorId` string, required — Connector ID
      - `defaultSystemPromptId` string — Default system prompt ID
      - `model` string — Model
      - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
      - `name` string, required — The name of the connector
    - `combined_filter` object
    - `end` string
    - `filters` unknown[] — The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
      - unknown
    - `query` SecurityAttackDiscoveryAPIQuery — An query condition to filter alerts
      - `language` string, required
      - `query` union, required
        - string
        - object
    - `size` number, required
    - `start` string
  - `schedule` SecurityAttackDiscoveryAPIIntervalApiSchedule, required
    - `interval` string, required — The schedule interval
  - `updated_at` string, date-time, required — The date the schedule was updated
  - `updated_by` string, required — The name of the user that updated the schedule

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)