---
title: "Find Attack Discovery schedules that match the search criteria"
method: GET
path: "/api/attack_discovery/schedules/_find"
tags: ["Security Attack discovery API"]
---

# Find Attack Discovery schedules that match the search criteria

`GET /api/attack_discovery/schedules/_find`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/_find</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.

## Query parameters

- `page` number
- `per_page` number
- `sort_field` string, nonempty — A string that does not contain only whitespace characters.
- `sort_direction` 'asc' | 'desc'

## Response `200`

Indicates a successful call.

- object
  - `data` SecurityAttackDiscoveryAPIAttackDiscoveryApiSchedule[], required — Array of matched Attack Discovery schedule objects.
    - `actions` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleAction[], required — The Attack Discovery schedule actions
      - union
        - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleGeneralAction
          - `action_type_id` string, required — The action type used for sending notifications.
          - `alerts_filter` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionAlertsFilter
          - `frequency` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionFrequency — The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
            - `notify_when` 'onActiveAlert' | 'onThrottleInterval' | 'onActionGroupChange', required — The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`
            - `summary` boolean, required — Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
            - `throttle` string, required — Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
          - `group` string, required — Groups actions by use cases. Use `default` for alert notifications.
          - `id` string, required — The connector ID.
          - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
          - `uuid` string, nonempty — A string that does not contain only whitespace characters.
        - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleSystemAction
          - `action_type_id` string, required — The action type used for sending notifications.
          - `id` string, required — The connector ID.
          - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
          - `uuid` string, nonempty — A string that does not contain only whitespace characters.
    - `created_at` string, date-time, required — The date the schedule was created
    - `created_by` string, required — The name of the user that created the schedule
    - `enabled` boolean, required — Indicates whether the schedule is enabled
    - `id` string, required — UUID of Attack Discovery schedule
    - `last_execution` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleExecution — An Attack Discovery schedule execution information
      - `date` string, date-time, required — Date of the execution
      - `duration` number — Duration of the execution
      - `message` string
      - `status` 'ok' | 'active' | 'error' | 'unknown' | 'warning', required — An Attack Discovery schedule execution status
    - `name` string, required — The name of the schedule
    - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleParams, required — An Attack Discovery schedule params
      - `alerts_index_pattern` string, required — The index pattern to get alerts from
      - `api_config` object, required — LLM API configuration.
        - `actionTypeId` string, required — Action type ID
        - `connectorId` string, required — Connector ID
        - `defaultSystemPromptId` string — Default system prompt ID
        - `model` string — Model
        - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
        - `name` string, required — The name of the connector
      - `combined_filter` object
      - `end` string
      - `filters` unknown[] — The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
        - unknown
      - `query` SecurityAttackDiscoveryAPIQuery — An query condition to filter alerts
        - `language` string, required
        - `query` union, required
          - string
          - object
      - `size` number, required
      - `start` string
    - `schedule` SecurityAttackDiscoveryAPIIntervalApiSchedule, required
      - `interval` string, required — The schedule interval
    - `updated_at` string, date-time, required — The date the schedule was updated
    - `updated_by` string, required — The name of the user that updated the schedule
  - `page` number, required — Current page number of the paginated result set.
  - `per_page` number, required — Number of items requested per page.
  - `total` number, required — Total number of Attack Discovery schedules matching the query (across all pages).

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)