Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Attack discovery API

Find Attack discoveries that match the search criteria

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_find</span></div>

Refer to Spaces for more information.

Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.

get/api/attack_discovery/_find

Query parameters

alert_idsstring[]

Filter results to Attack discoveries that include any of the provided alert IDs

connector_namesstring[]

Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable connector_name property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from connector_id values used to generate Attack discoveries.

enable_field_renderingboolean

Enables a markdown syntax used to render pivot fields, for example {{ user.name james }}. When disabled, the same example would be rendered as james. This is primarily used for Attack Discovery views within Kibana. Defaults to false.

endstring

End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").

idsstring[]

Filter results to the Attack discoveries with the specified IDs

include_unique_alert_idsboolean

If true, the response will include unique_alert_ids and unique_alert_ids_count aggregated across the matched Attack discoveries

pageinteger

Page number to return (used for pagination). Defaults to 1.

per_pageinteger

Number of Attack discoveries to return per page (used for pagination). Defaults to 10.

searchstring

Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)

sharedboolean

Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use true to return only shared discoveries, false to return only those visible to the current user. Mutually exclusive with include_all_authors.

include_all_authorsboolean

If true, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with shared.

scheduledboolean

Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use true to return only scheduled discoveries or false to return only ad-hoc discoveries.

sort_field'@timestamp'

Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values.

Field used to sort results. See AttackDiscoveryFindSortField for allowed values.

sort_order'asc' | 'desc'

The order in which results are sorted.

Example:asc

Sort order direction asc for ascending or desc for descending. Defaults to desc.

startstring

Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

statusstring[]

Filter by alert workflow status. Provide one or more of the allowed workflow states.

with_replacementsboolean

When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.

Response

Indicates a successful call.

connector_namesstring[] required

List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.

pageinteger required

Current page number of the paginated result set.

per_pageinteger required

Number of items requested per page.

totalinteger required

Total number of Attack discoveries matching the query (across all pages).

unique_alert_idsstring[]

List of unique alert IDs aggregated from the matched Attack discoveries. Only present if include_unique_alert_ids=true in the request.

unique_alert_ids_countinteger required

Number of unique alert IDs across all matched Attack discoveries. Only present if include_unique_alert_ids=true in the request.

Example response

{
  "data": [
    {
      "timestamp": "2023-10-31T12:00:00Z",
      "users": [
        {
          "id": "user123",
          "name": "John Doe"
        }
      ]
    }
  ]
}