Elastic Stack

Elastic Stack (ELK Stack) Security Attack discovery API

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 16

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/attack_discovery/_bulk Bulk update Attack discoveries · Bulk update Attack discoveries #
Ask an LLM
“Can I change the workflow status of many Attack discoveries at once?”
“How do I mark a batch of attack findings as acknowledged or shared in one request?”
Tell an agent
Apply the bulk Attack discovery update {update}.
Change the workflow status and visibility of discoveries using {update}.
GET /api/attack_discovery/_find Search Attack discoveries · Find Attack discoveries that match the search criteria #
Ask an LLM
“Which Attack discoveries were found in the last day?”
“Can I filter discoveries by status, connector or the alerts they reference?”
Tell an agent
Find Attack discoveries matching {search}.
List discoveries with status {status} between {start} and {end}.
POST /api/attack_discovery/_generate Generate attack discoveries from alerts with AI · Generate attack discoveries from alerts #
Ask an LLM
“How do I have an AI connector analyse my security alerts for attack chains?”
“Can I limit how many alerts Attack Discovery analyses in one run?”
Tell an agent
Generate attack discoveries from alerts in {alertsIndexPattern}, analysing up to {size} alerts with connector config {apiConfig}.
Run Attack Discovery on {alertsIndexPattern} from {start} to {end} using connector {connectorName}.
GET /api/attack_discovery/generations List my recent Attack Discovery generations · Get the latest Attack Discovery generations metadata for the current user #
Ask an LLM
“What is the status of my recent Attack Discovery runs?”
“Can I see only the scheduled generations and their statistics?”
Tell an agent
List my latest Attack Discovery generations.
Show the last {size} generations between {start} and {end}.
GET /api/attack_discovery/generations/{execution_uuid} Get one Attack Discovery generation · Get a single Attack Discovery generation, including its discoveries and… #
Ask an LLM
“Which attack discoveries did a particular generation run produce?”
“Can I retrieve a generation's results with anonymized values replaced?”
Tell an agent
Get Attack Discovery generation {execution_uuid}.
Show the discoveries from run {execution_uuid} with replacements set to {with_replacements}.
POST /api/attack_discovery/generations/{execution_uuid}/_dismiss Dismiss an Attack Discovery generation · Dismiss an Attack Discovery generation #
Ask an LLM
“How do I stop a finished generation from showing in the UI?”
“What does dismissing an Attack Discovery generation change?”
Tell an agent
Dismiss Attack Discovery generation {execution_uuid}.
Hide the generation {execution_uuid} from my status view.
POST /api/attack_discovery/schedules Create an Attack Discovery schedule · Create Attack Discovery schedule #
Ask an LLM
“Can Attack Discovery run automatically on an interval?”
“How do I set up recurring AI analysis of alerts with actions when findings appear?”
Tell an agent
Create an Attack Discovery schedule {name} running every {schedule} with params {params}.
Schedule {name} on interval {schedule} with params {params} and notify via {actions}.
POST /api/attack_discovery/schedules/_bulk_delete Delete several Attack Discovery schedules · Bulk delete Attack Discovery schedules #
Ask an LLM
“Can I delete multiple Attack Discovery schedules at once?”
“What removes a list of discovery schedules by ID?”
Tell an agent destructive · confirm first
Bulk delete Attack Discovery schedules {ids}.
Remove all of these discovery schedules: {ids}.
POST /api/attack_discovery/schedules/_bulk_disable Disable several Attack Discovery schedules · Bulk disable Attack Discovery schedules #
Ask an LLM
“Can I pause a set of Attack Discovery schedules together?”
“Which call disables multiple discovery schedules by ID?”
Tell an agent
Bulk disable Attack Discovery schedules {ids}.
Pause all of these discovery schedules: {ids}.
POST /api/attack_discovery/schedules/_bulk_enable Enable several Attack Discovery schedules · Bulk enable Attack Discovery schedules #
Ask an LLM
“Can I resume a group of paused Attack Discovery schedules together?”
“Which call enables multiple discovery schedules by ID?”
Tell an agent
Bulk enable Attack Discovery schedules {ids}.
Resume all of these discovery schedules: {ids}.
GET /api/attack_discovery/schedules/_find List Attack Discovery schedules · Find Attack Discovery schedules that match the search criteria #
Ask an LLM
“What Attack Discovery schedules are configured?”
“Can I sort discovery schedules by a field and page through them?”
Tell an agent
List my Attack Discovery schedules.
Show discovery schedules sorted by {sort_field} {sort_direction}, page {page}.
DELETE /api/attack_discovery/schedules/{id} Delete an Attack Discovery schedule · Delete Attack Discovery schedule #
Ask an LLM
“How do I permanently remove one Attack Discovery schedule?”
“Is deleting a discovery schedule reversible?”
Tell an agent destructive · confirm first
Delete Attack Discovery schedule {id}.
Permanently remove discovery schedule {id}.
GET /api/attack_discovery/schedules/{id} Get an Attack Discovery schedule · Get Attack Discovery schedule by ID #
Ask an LLM
“What interval, parameters and actions does one discovery schedule have?”
“Can I see a schedule's execution history?”
Tell an agent
Get Attack Discovery schedule {id}.
Show the configuration and run history of discovery schedule {id}.
PUT /api/attack_discovery/schedules/{id} Replace an Attack Discovery schedule's settings · Update Attack Discovery schedule #
Ask an LLM
“How do I change the interval or connector of an existing discovery schedule?”
“Does updating a discovery schedule replace its whole configuration?”
Tell an agent
Update discovery schedule {id}: name {name}, interval {schedule}, params {params}, actions {actions}.
Reconfigure schedule {id} to run every {schedule} as {name} with params {params} and actions {actions}.
POST /api/attack_discovery/schedules/{id}/_disable Disable an Attack Discovery schedule · Disable Attack Discovery schedule #
Ask an LLM
“How do I pause one discovery schedule but keep its settings?”
“Will a running execution finish if I disable its schedule?”
Tell an agent
Disable Attack Discovery schedule {id}.
Stop discovery schedule {id} from starting new runs.
POST /api/attack_discovery/schedules/{id}/_enable Enable an Attack Discovery schedule · Enable Attack Discovery schedule #
Ask an LLM
“How do I turn a disabled discovery schedule back on?”
“When does a re-enabled discovery schedule run next?”
Tell an agent
Enable Attack Discovery schedule {id}.
Resume discovery schedule {id} on its interval.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-attack-discovery-api-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-attack-discovery-api-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-attack-discovery-api-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Security Attack discovery API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (133 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-attack-discovery-api-api-openapi.yml