# Elastic Stack (ELK Stack) Security Attack discovery API

**Canonical:** https://apis.io/apis/elk-stack/elk-stack-security-attack-discovery-api-api/  
**Provider:** Elastic Stack (ELK Stack) — https://apis.io/providers/elk-stack/  
**Base URL:** https://{elasticsearch_endpoint}  
**Documentation:** https://www.elastic.co/docs/api/doc/elasticsearch/

Elastic Stack (ELK Stack) Security Attack discovery API is one of 132 APIs that [Elastic Stack (ELK Stack)](https://apis.io/providers/elk-stack/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Security Attack discovery API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.

## Operations (16)

| Method | Path | Summary |
|---|---|---|
| POST | `/api/attack_discovery/_bulk` | Bulk update Attack discoveries |
| GET | `/api/attack_discovery/_find` | Find Attack discoveries that match the search criteria |
| POST | `/api/attack_discovery/_generate` | Generate attack discoveries from alerts |
| GET | `/api/attack_discovery/generations` | Get the latest Attack Discovery generations metadata for the current user |
| GET | `/api/attack_discovery/generations/{execution_uuid}` | Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata |
| POST | `/api/attack_discovery/generations/{execution_uuid}/_dismiss` | Dismiss an Attack Discovery generation |
| POST | `/api/attack_discovery/schedules` | Create Attack Discovery schedule |
| POST | `/api/attack_discovery/schedules/_bulk_delete` | Bulk delete Attack Discovery schedules |
| POST | `/api/attack_discovery/schedules/_bulk_disable` | Bulk disable Attack Discovery schedules |
| POST | `/api/attack_discovery/schedules/_bulk_enable` | Bulk enable Attack Discovery schedules |
| GET | `/api/attack_discovery/schedules/_find` | Find Attack Discovery schedules that match the search criteria |
| DELETE | `/api/attack_discovery/schedules/{id}` | Delete Attack Discovery schedule |
| GET | `/api/attack_discovery/schedules/{id}` | Get Attack Discovery schedule by ID |
| PUT | `/api/attack_discovery/schedules/{id}` | Update Attack Discovery schedule |
| POST | `/api/attack_discovery/schedules/{id}/_disable` | Disable Attack Discovery schedule |
| POST | `/api/attack_discovery/schedules/{id}/_enable` | Enable Attack Discovery schedule |

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-attack-discovery-api-api-openapi.yml
- **Documentation** — https://www.elastic.co/docs/reference/elasticsearch
- **APIReference** — https://www.elastic.co/docs/api/doc/elasticsearch/
- **SourceCode** — https://github.com/elastic/elasticsearch-specification
- **Documentation** — https://www.elastic.co/docs/reference/kibana
- **APIReference** — https://www.elastic.co/docs/api/doc/kibana/
- **SourceCode** — https://github.com/elastic/kibana
- **ToolCrosswalk** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

## Other Elastic Stack (ELK Stack) APIs (12)

- [Elastic Cloud API](https://apis.io/apis/elk-stack/elastic-cloud-api/)
- [Elastic Stack (ELK Stack) Accounts API](https://apis.io/apis/elk-stack/elk-stack-accounts-api/)
- [Elastic Stack (ELK Stack) Actions API](https://apis.io/apis/elk-stack/elk-stack-actions-api/)
- [Elastic Stack (ELK Stack) agent builder API](https://apis.io/apis/elk-stack/elk-stack-agent-builder-api/)
- [Elastic Stack (ELK Stack) Alerting API](https://apis.io/apis/elk-stack/elk-stack-alerting-api/)
- [Elastic Stack (ELK Stack) Alerting V2 API](https://apis.io/apis/elk-stack/elk-stack-alerting-v2-api/)
- [Elastic Stack (ELK Stack) Analytics API](https://apis.io/apis/elk-stack/elk-stack-analytics-api/)
- [Elastic Stack (ELK Stack) APM agent configuration API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-configuration-api/)
- [Elastic Stack (ELK Stack) APM agent keys API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-keys-api/)
- [Elastic Stack (ELK Stack) APM annotations API](https://apis.io/apis/elk-stack/elk-stack-apm-annotations-api/)
- [Elastic Stack (ELK Stack) APM server schema API](https://apis.io/apis/elk-stack/elk-stack-apm-server-schema-api/)
- [Elastic Stack (ELK Stack) APM sourcemaps API](https://apis.io/apis/elk-stack/elk-stack-apm-sourcemaps-api/)

## Tags

Security Attack discovery API

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/elk-stack/elk-stack-security-attack-discovery-api-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/elk-stack/.