How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Elastic Stack (ELK Stack) Security Attack discovery API

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.

Elastic Stack (ELK Stack) Security Attack discovery API is one of 132 APIs that Elastic Stack (ELK Stack) publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security Attack discovery API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 16 operations across 14 paths, and defines 37 schemas. It is described by OpenAPI 3.2.0.

Requests are made against a single base URL, https://{kibana_url}.

16 operations 14 paths 37 schemas 1 DELETE5 GET9 POST1 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
Base URL
https://{elasticsearch_endpoint}
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Elastic Stack (ELK Stack) Security Attack discovery API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 16

Across 14 paths, the API surfaces 16 operations — 1 DELETE, 5 GET, 9 POST, 1 PUT. Each is listed below with its method, path, parameters, and response codes.

Security Attack discovery API 16

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify…

POST
/api/attack_discovery/_bulk
Bulk update Attack discoveries
PostAttackDiscoveryBulk body → 200400
GET
/api/attack_discovery/_find
Find Attack discoveries that match the search criteria
AttackDiscoveryFind 17 params → 200400
POST
/api/attack_discovery/_generate
Generate attack discoveries from alerts
PostAttackDiscoveryGenerate body → 200400
GET
/api/attack_discovery/generations
Get the latest Attack Discovery generations metadata for the current user
GetAttackDiscoveryGenerations 4 params → 200400
GET
/api/attack_discovery/generations/{execution_uuid}
Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
GetAttackDiscoveryGeneration 3 params → 200400
POST
/api/attack_discovery/generations/{execution_uuid}/_dismiss
Dismiss an Attack Discovery generation
PostAttackDiscoveryGenerationsDismiss 1 param → 200400
POST
/api/attack_discovery/schedules
Create Attack Discovery schedule
CreateAttackDiscoverySchedules body → 200400
POST
/api/attack_discovery/schedules/_bulk_delete
Bulk delete Attack Discovery schedules
BulkDeleteAttackDiscoverySchedules body → 200400
POST
/api/attack_discovery/schedules/_bulk_disable
Bulk disable Attack Discovery schedules
BulkDisableAttackDiscoverySchedules body → 200400
POST
/api/attack_discovery/schedules/_bulk_enable
Bulk enable Attack Discovery schedules
BulkEnableAttackDiscoverySchedules body → 200400
GET
/api/attack_discovery/schedules/_find
Find Attack Discovery schedules that match the search criteria
FindAttackDiscoverySchedules 4 params → 200400
DELETE
/api/attack_discovery/schedules/{id}
Delete Attack Discovery schedule
DeleteAttackDiscoverySchedules 1 param → 200400
GET
/api/attack_discovery/schedules/{id}
Get Attack Discovery schedule by ID
GetAttackDiscoverySchedules 1 param → 200400
PUT
/api/attack_discovery/schedules/{id}
Update Attack Discovery schedule
UpdateAttackDiscoverySchedules 1 param body → 200400
POST
/api/attack_discovery/schedules/{id}/_disable
Disable Attack Discovery schedule
DisableAttackDiscoverySchedules 1 param → 200400
POST
/api/attack_discovery/schedules/{id}/_enable
Enable Attack Discovery schedule
EnableAttackDiscoverySchedules 1 param → 200400

Schemas 37

The contract defines 37 schemas that model the data the API accepts and returns. The most detailed are Security_Attack_discovery_API_AttackDiscoveryApiAlert (26 properties), Security_Attack_discovery_API_AttackDiscoveryGeneration (22 properties), Security_Attack_discovery_API_AttackDiscoveryGenerationConfig (11 properties), Security_Attack_discovery_API_AttackDiscoveryApiSchedule (11 properties). Each schema is shown below with its type and property counts.

Security_Attack_discovery_API_WorkflowExecutionsTracking
object
Workflow execution tracking for manual orchestration
4 properties
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup
string
Groups actions by use cases. Use default for alert notifications.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams
object
An Attack Discovery schedule params
8 properties 3 required
Security_Attack_discovery_API_Provider
string
Provider
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter
object
Security_Attack_discovery_API_SortOrder
string
The order in which results are sorted.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle
string
Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
Security_Attack_discovery_API_Replacements
object
Replacements object used to anonymize/deanonymize messages
Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction
object
7 properties 4 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency
object
The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
3 properties 3 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId
string
The connector ID.
Security_Attack_discovery_API_NonEmptyTimestamp
string
A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
Security_Attack_discovery_API_AttackDiscoveryFindSortField
string
Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen
string
The condition for throttling the notification: onActionGroupChange, onActiveAlert, or onThrottleInterval
Security_Attack_discovery_API_IntervalApiSchedule
object
1 property 1 required
Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody
object
1 property 1 required
Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse
object
3 properties 3 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps
object
An Attack Discovery schedule create properties
5 properties 3 required
Security_Attack_discovery_API_AnonymizationFieldResponse
object
10 properties 2 required
Security_Attack_discovery_API_NonEmptyString
string
A string that does not contain only whitespace characters.
Security_Attack_discovery_API_AttackDiscoveryGeneration
object
22 properties 5 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution
object
An Attack Discovery schedule execution information
4 properties 3 required
Security_Attack_discovery_API_ApiConfig
object
5 properties 2 required
Security_Attack_discovery_API_AttackDiscoveryGenerationConfig
object
11 properties 5 required
Security_Attack_discovery_API_User
object
Could be any string, not necessarily a UUID.
2 properties
Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus
string
An Attack Discovery schedule execution status
Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction
Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesError
object
3 properties 2 required
Security_Attack_discovery_API_Query
object
An query condition to filter alerts
2 properties 2 required
Security_Attack_discovery_API_AttackDiscoveryGenericError
object
Error response for Attack discovery schedule operations when the request is rejected. Uses statuscode (snakecase), error, and message to match the implementati…
3 properties
Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction
object
4 properties 3 required
Security_Attack_discovery_API_Filters
array
The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
Security_Attack_discovery_API_AttackDiscoveryApiSchedule
object
An Attack Discovery schedule
11 properties 10 required
Security_Attack_discovery_API_AttackDiscoveryApiAlert
object
An attack discovery that's also an alert (Public API with snakecase)
26 properties 9 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams
object
Object containing the allowed connector fields, which varies according to the connector type.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps
object
An Attack Discovery schedule update properties
4 properties 4 required
Security_Attack_discovery_API_WorkflowExecutionReference
object
3 properties 2 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

elk-stack-security-attack-discovery-api-api-openapi.yml Raw ↑

Other APIs Elastic Stack (ELK Stack) publishes across the network.

Elastic Cloud API
Elastic Stack (ELK Stack) Accounts API
Elastic Stack (ELK Stack) Actions API
Elastic Stack (ELK Stack) agent builder API
Elastic Stack (ELK Stack) Alerting API
Elastic Stack (ELK Stack) Alerting V2 API
Elastic Stack (ELK Stack) Analytics API
Elastic Stack (ELK Stack) APM agent configuration API
Elastic Stack (ELK Stack) APM agent keys API
Elastic Stack (ELK Stack) APM annotations API
Elastic Stack (ELK Stack) APM server schema API
Elastic Stack (ELK Stack) APM sourcemaps API
Where this information came from

This is an independent, third-party profile of Elastic Stack (ELK Stack) Security Attack discovery API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.