---
title: "Create Attack Discovery schedule"
method: POST
path: "/api/attack_discovery/schedules"
tags: ["Security Attack discovery API"]
---

# Create Attack Discovery schedule

`POST /api/attack_discovery/schedules`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.

## Request body

- SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleCreateProps — An Attack Discovery schedule create properties
  - `actions` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleAction[] — The Attack Discovery schedule actions
    - union
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleGeneralAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `alerts_filter` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionAlertsFilter
        - `frequency` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionFrequency — The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
          - `notify_when` 'onActiveAlert' | 'onThrottleInterval' | 'onActionGroupChange', required — The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`
          - `summary` boolean, required — Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          - `throttle` string, required — Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
        - `group` string, required — Groups actions by use cases. Use `default` for alert notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleSystemAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
  - `enabled` boolean — Indicates whether the schedule is enabled
  - `name` string, required — The name of the schedule
  - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleParams, required — An Attack Discovery schedule params
    - `alerts_index_pattern` string, required — The index pattern to get alerts from
    - `api_config` object, required — LLM API configuration.
      - `actionTypeId` string, required — Action type ID
      - `connectorId` string, required — Connector ID
      - `defaultSystemPromptId` string — Default system prompt ID
      - `model` string — Model
      - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
      - `name` string, required — The name of the connector
    - `combined_filter` object
    - `end` string
    - `filters` unknown[] — The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
      - unknown
    - `query` SecurityAttackDiscoveryAPIQuery — An query condition to filter alerts
      - `language` string, required
      - `query` union, required
        - string
        - object
    - `size` number, required
    - `start` string
  - `schedule` SecurityAttackDiscoveryAPIIntervalApiSchedule, required
    - `interval` string, required — The schedule interval

## Response `200`

The Attack Discovery schedule was successfully created.

- SecurityAttackDiscoveryAPIAttackDiscoveryApiSchedule — An Attack Discovery schedule
  - `actions` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleAction[], required — The Attack Discovery schedule actions
    - union
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleGeneralAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `alerts_filter` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionAlertsFilter
        - `frequency` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionFrequency — The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
          - `notify_when` 'onActiveAlert' | 'onThrottleInterval' | 'onActionGroupChange', required — The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval`
          - `summary` boolean, required — Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
          - `throttle` string, required — Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
        - `group` string, required — Groups actions by use cases. Use `default` for alert notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
      - SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleSystemAction
        - `action_type_id` string, required — The action type used for sending notifications.
        - `id` string, required — The connector ID.
        - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleActionParams, required — Object containing the allowed connector fields, which varies according to the connector type.
        - `uuid` string, nonempty — A string that does not contain only whitespace characters.
  - `created_at` string, date-time, required — The date the schedule was created
  - `created_by` string, required — The name of the user that created the schedule
  - `enabled` boolean, required — Indicates whether the schedule is enabled
  - `id` string, required — UUID of Attack Discovery schedule
  - `last_execution` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleExecution — An Attack Discovery schedule execution information
    - `date` string, date-time, required — Date of the execution
    - `duration` number — Duration of the execution
    - `message` string
    - `status` 'ok' | 'active' | 'error' | 'unknown' | 'warning', required — An Attack Discovery schedule execution status
  - `name` string, required — The name of the schedule
  - `params` SecurityAttackDiscoveryAPIAttackDiscoveryApiScheduleParams, required — An Attack Discovery schedule params
    - `alerts_index_pattern` string, required — The index pattern to get alerts from
    - `api_config` object, required — LLM API configuration.
      - `actionTypeId` string, required — Action type ID
      - `connectorId` string, required — Connector ID
      - `defaultSystemPromptId` string — Default system prompt ID
      - `model` string — Model
      - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
      - `name` string, required — The name of the connector
    - `combined_filter` object
    - `end` string
    - `filters` unknown[] — The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
      - unknown
    - `query` SecurityAttackDiscoveryAPIQuery — An query condition to filter alerts
      - `language` string, required
      - `query` union, required
        - string
        - object
    - `size` number, required
    - `start` string
  - `schedule` SecurityAttackDiscoveryAPIIntervalApiSchedule, required
    - `interval` string, required — The schedule interval
  - `updated_at` string, date-time, required — The date the schedule was updated
  - `updated_by` string, required — The name of the user that updated the schedule

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)