---
title: "Find and/or aggregate attack discovery alerts"
method: POST
path: "/api/detection_engine/attacks/search"
tags: ["Security Detections API"]
---

# Find and/or aggregate attack discovery alerts

`POST /api/detection_engine/attacks/search`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/attacks/search</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only.

## Request body

- SecurityDetectionsAPIQueryAlertsBodyParams
  - `_source` union
    - boolean
    - string
    - string[]
  - `aggs` object
  - `fields` string[]
  - `query` object
  - `runtime_mappings` object
  - `size` integer
  - `sort` union
    - union
      - string
      - object
    - SecurityDetectionsAPIAlertsSortCombinations[]
      - union
        - string
        - object
  - `track_total_hits` boolean

## Response `200`

Successful response

- object — Elasticsearch search response

## Other responses

- `400` — Invalid input data response
- `401` — Unsuccessful authentication response
- `500` — Internal server error response

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)