Need help with your APIs? I offer API discovery, governance & evangelism services. Explore services →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Kibana Security Attack discovery API API

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.

Kibana Security Attack discovery API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security Attack discovery API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

This API exposes 13 operations across 11 paths, and defines 32 schemas. It is described by OpenAPI 3.0.3.

Requests are made against a single base URL, https://{kibana_url}.

13 operations 11 paths 32 schemas 1 DELETE5 GET6 POST1 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.3
Base URL
https://localhost:5601/api
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Kibana Security Attack discovery API API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 13

Across 11 paths, the API surfaces 13 operations — 1 DELETE, 5 GET, 6 POST, 1 PUT. Each is listed below with its method, path, parameters, and response codes.

Security Attack discovery API 13

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify…

POST
/api/attack_discovery/_bulk
Bulk update Attack discoveries
PostAttackDiscoveryBulk body → 200400
GET
/api/attack_discovery/_find
Find Attack discoveries that match the search criteria
AttackDiscoveryFind 16 params → 200400
POST
/api/attack_discovery/_generate
Generate attack discoveries from alerts
PostAttackDiscoveryGenerate body → 200400
GET
/api/attack_discovery/generations
Get the latest Attack Discovery generations metadata for the current user
GetAttackDiscoveryGenerations 3 params → 200400
GET
/api/attack_discovery/generations/{execution_uuid}
Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
GetAttackDiscoveryGeneration 3 params → 200400
POST
/api/attack_discovery/generations/{execution_uuid}/_dismiss
Dismiss an Attack Discovery generation
PostAttackDiscoveryGenerationsDismiss 1 param → 200400
POST
/api/attack_discovery/schedules
Create Attack Discovery schedule
CreateAttackDiscoverySchedules body → 200400
GET
/api/attack_discovery/schedules/_find
Find Attack Discovery schedules that match the search criteria
FindAttackDiscoverySchedules 4 params → 200400
DELETE
/api/attack_discovery/schedules/{id}
Delete Attack Discovery schedule
DeleteAttackDiscoverySchedules 1 param → 200400
GET
/api/attack_discovery/schedules/{id}
Get Attack Discovery schedule by ID
GetAttackDiscoverySchedules 1 param → 200400
PUT
/api/attack_discovery/schedules/{id}
Update Attack Discovery schedule
UpdateAttackDiscoverySchedules 1 param body → 200400
POST
/api/attack_discovery/schedules/{id}/_disable
Disable Attack Discovery schedule
DisableAttackDiscoverySchedules 1 param → 200400
POST
/api/attack_discovery/schedules/{id}/_enable
Enable Attack Discovery schedule
EnableAttackDiscoverySchedules 1 param → 200400

Schemas 32

The contract defines 32 schemas that model the data the API accepts and returns. The most detailed are Security_Attack_discovery_API_AttackDiscoveryApiAlert (26 properties), Security_Attack_discovery_API_AttackDiscoveryGenerationConfig (11 properties), Security_Attack_discovery_API_AttackDiscoveryApiSchedule (11 properties), Security_Attack_discovery_API_AnonymizationFieldResponse (10 properties). Each schema is shown below with its type and property counts.

Security_Attack_discovery_API_AttackDiscoveryGenericError
object
Error response for Attack discovery schedule operations when the request is rejected. Uses statuscode (snakecase), error, and message to match the implementati…
3 properties
Security_Attack_discovery_API_AttackDiscoveryGenerationConfig
object
11 properties 5 required
Security_Attack_discovery_API_NonEmptyString
string
A string that does not contain only whitespace characters.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams
object
An Attack Discovery schedule params
8 properties 3 required
Security_Attack_discovery_API_ApiConfig
object
5 properties 2 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter
object
Security_Attack_discovery_API_AttackDiscoveryApiSchedule
object
An Attack Discovery schedule
11 properties 10 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId
string
The connector ID.
Security_Attack_discovery_API_Filters
array
The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps
object
An Attack Discovery schedule update properties
4 properties 4 required
Security_Attack_discovery_API_AttackDiscoveryApiAlert
object
An attack discovery that's also an alert (Public API with snakecase)
26 properties 9 required
Security_Attack_discovery_API_NonEmptyTimestamp
string
A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
Security_Attack_discovery_API_Provider
string
Provider
Security_Attack_discovery_API_Replacements
object
Replacements object used to anonymize/deanonymize messages
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen
string
The condition for throttling the notification: onActionGroupChange, onActiveAlert, or onThrottleInterval
Security_Attack_discovery_API_AttackDiscoveryGeneration
object
10 properties 6 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution
object
An Attack Discovery schedule execution information
4 properties 3 required
Security_Attack_discovery_API_AttackDiscoveryFindSortField
string
Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle
string
Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.
Security_Attack_discovery_API_User
object
Could be any string, not necessarily a UUID.
2 properties
Security_Attack_discovery_API_IntervalApiSchedule
object
1 property 1 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction
object
4 properties 3 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction
object
7 properties 4 required
Security_Attack_discovery_API_Query
object
An query condition to filter alerts
2 properties 2 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps
object
An Attack Discovery schedule create properties
5 properties 3 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup
string
Groups actions by use cases. Use default for alert notifications.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus
string
An Attack Discovery schedule execution status
Security_Attack_discovery_API_AnonymizationFieldResponse
object
10 properties 2 required
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams
object
Object containing the allowed connector fields, which varies according to the connector type.
Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency
object
The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).
3 properties 3 required
Security_Attack_discovery_API_SortOrder
string
The order in which results are sorted.

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

kibana-security-attack-discovery-api-api-openapi.yml Raw ↑

Other APIs Kibana publishes across the network.

Kibana Actions API
Kibana agent builder API
Kibana alerting API
Kibana APM agent configuration API
Kibana APM agent keys API
Kibana APM annotations API
Kibana APM server schema API
Kibana APM sourcemaps API
Kibana cases API
Kibana connectors API
Kibana Data streams API
Kibana data views API