---
title: "Get the latest Attack Discovery generations metadata for the current user"
method: GET
path: "/api/attack_discovery/generations"
tags: ["Security Attack discovery API"]
---

# Get the latest Attack Discovery generations metadata for the current user

`GET /api/attack_discovery/generations`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.

## Query parameters

- `end` string
- `size` number
- `scheduled` boolean
- `start` string

## Response `200`

Indicates a successful call.

- object
  - `generations` SecurityAttackDiscoveryAPIAttackDiscoveryGeneration[], required — List of Attack Discovery generations
    - `alerts_context_count` number — The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
    - `connector_id` string, required — The connector id (event.dataset) for this generation
    - `connector_stats` object — Stats applicable to the connector for this generation
      - `average_successful_duration_nanoseconds` number — The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user
      - `successful_generations` number — The number of successful generations for the same connector id, for the current user
    - `conversation_id` string — Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
    - `discoveries` number, required — The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
    - `duplicates_dropped_count` integer — The number of attack discoveries dropped as duplicates during the persist step
    - `end` string — When generation ended (max event.end)
    - `error_category` string — Structured error category from server classification (optional; absent for successful generations)
    - `execution_uuid` string, required — The unique identifier (kibana.alert.rule.execution.uuid) for the generation
    - `failed_workflow_id` string — Workflow ID that caused the failure (optional; absent for successful generations)
    - `generated_count` integer — The number of attack discoveries generated before deduplication and hallucination filtering
    - `hallucinations_filtered_count` integer — The number of attack discoveries filtered as hallucinations during the validation step
    - `loading_message` string — Generation loading message (kibana.alert.rule.execution.status)
    - `persisted_count` integer — The number of attack discoveries successfully persisted after deduplication and hallucination filtering
    - `reason` string — Reason for failed generations (event.reason)
    - `source_metadata` object, nullable — Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)
      - `action_execution_uuid` string — The action execution UUID from the alerting framework
      - `rule_id` string — The ID of the alerting rule that triggered this generation
      - `rule_name` string — The name of the alerting rule that triggered this generation
    - `start` string, required — When generation started (min event.start)
    - `status` 'canceled' | 'dismissed' | 'failed' | 'started' | 'succeeded', required — The status of the attack discovery generation
    - `step_event_actions` string[] — Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.
    - `workflow_executions` SecurityAttackDiscoveryAPIWorkflowExecutionsTracking — Workflow execution tracking for manual orchestration
      - `alertRetrieval` SecurityAttackDiscoveryAPIWorkflowExecutionReference[], nullable — Alert retrieval workflow executions (one per workflow invoked)
        - `workflowId` string, required — The workflow definition ID
        - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label)
        - `workflowRunId` string, required — The workflow execution ID
      - `gate` SecurityAttackDiscoveryAPIWorkflowExecutionReference[], nullable — Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers
        - `workflowId` string, required — The workflow definition ID
        - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label)
        - `workflowRunId` string, required — The workflow execution ID
      - `generation` SecurityAttackDiscoveryAPIWorkflowExecutionReference
        - `workflowId` string, required — The workflow definition ID
        - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label)
        - `workflowRunId` string, required — The workflow execution ID
      - `validation` SecurityAttackDiscoveryAPIWorkflowExecutionReference
        - `workflowId` string, required — The workflow definition ID
        - `workflowName` string — The human-readable workflow name (optional; used by the UI to display a label)
        - `workflowRunId` string, required — The workflow execution ID
    - `workflow_id` string — The workflow definition ID for deep linking
    - `workflow_run_id` string — The workflow execution ID for monitoring

## Other responses

- `400` — Bad Request response.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)