---
title: "Generate attack discoveries from alerts"
method: POST
path: "/api/attack_discovery/_generate"
tags: ["Security Attack discovery API"]
---

# Generate attack discoveries from alerts

`POST /api/attack_discovery/_generate`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_generate</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.

## Request body

- SecurityAttackDiscoveryAPIAttackDiscoveryGenerationConfig
  - `alertsIndexPattern` string, required — The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default
  - `anonymizationFields` SecurityAttackDiscoveryAPIAnonymizationFieldResponse[], required — The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the `/api/security_ai_assistant/anonymization_fields/_find` API (for a specific Kibana space) to provide this value.
    - `allowed` boolean — Whether this field is allowed to be sent to the model.
    - `anonymized` boolean — Whether this field should be anonymized.
    - `createdAt` string — Timestamp of when the anonymization field was created.
    - `createdBy` string — Username of the person who created the anonymization field.
    - `field` string, required — Name of the anonymization field.
    - `id` string, nonempty, required — A string that does not contain only whitespace characters.
    - `namespace` string — Kibana space in which this anonymization field exists.
    - `timestamp` string, nonempty — A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
    - `updatedAt` string — Timestamp of the last update.
    - `updatedBy` string — Username of the person who last updated the field.
  - `apiConfig` SecurityAttackDiscoveryAPIApiConfig, required
    - `actionTypeId` string, required — Action type ID
    - `connectorId` string, required — Connector ID
    - `defaultSystemPromptId` string — Default system prompt ID
    - `model` string — Model
    - `provider` 'OpenAI' | 'Azure OpenAI' | 'Other' — Provider
  - `connectorName` string
  - `end` string
  - `filter` object — An Elasticsearch-style query DSL object used to filter alerts. For example: ```json { "filter": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "term": { "user.name": { "value": "james" } } } ], "minimum_should_match": 1 } } ], "should": [], "must_not": [] } } } ```
  - `model` string
  - `replacements` SecurityAttackDiscoveryAPIReplacements — Replacements object used to anonymize/deanonymize messages
  - `size` number, required
  - `start` string
  - `subAction` 'invokeAI' | 'invokeStream', required

## Response `200`

Indicates a successful call.

- object
  - `execution_uuid` string, nonempty, required — A string that does not contain only whitespace characters.

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)