Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Security Attack discovery API API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.
name: Security Attack discovery API
x-displayName: Security Attack discovery
paths:
/api/attack_discovery/_bulk:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/attack_discovery/_bulk</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.'
operationId: PostAttackDiscoveryBulk
requestBody:
content:
application/json:
examples:
PostAttackDiscoveryBulkRequestBodyExample:
summary: Acknowledge two Attack discoveries in bulk.
value:
update:
enable_field_rendering: false
ids:
- c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
- 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
kibana_alert_workflow_status: acknowledged
with_replacements: true
schema:
type: object
properties:
update:
description: Configuration object containing all parameters for the bulk update operation
type: object
properties:
enable_field_rendering:
default: false
description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
example: false
type: boolean
ids:
description: Array of Attack Discovery IDs to update
example:
- c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
- 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
items:
type: string
type: array
kibana_alert_workflow_status:
description: When provided, update the kibana.alert.workflow_status of the attack discovery alerts
enum:
- open
- acknowledged
- closed
example: acknowledged
type: string
visibility:
description: When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field
enum:
- not_shared
- shared
example: shared
type: string
with_replacements:
default: true
description: When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`.
example: true
type: boolean
required:
- ids
required:
- update
description: Bulk update parameters for Attack discoveries
required: true
responses:
'200':
content:
application/json:
examples:
PostAttackDiscoveryBulkResponse200Example:
summary: A successful bulk update response containing the modified Attack discoveries.
value:
data:
- alert_ids:
- alert-abc-1
alert_workflow_status: acknowledged
connector_id: gen-ai-connector
connector_name: OpenAI GPT-4
details_markdown: '- **Host** `workstation-01` showed credential access patterns consistent with mimikatz.'
generation_uuid: 550e8400-e29b-41d4-a716-446655440000
id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
summary_markdown: A user account was compromised using mimikatz to dump credentials.
timestamp: '2024-01-15T10:00:00.000Z'
title: Credential theft via mimikatz
schema:
type: object
properties:
data:
description: Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request.
items:
$ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
type: array
required:
- data
description: Indicates a successful call.
'400':
content:
application/json:
examples:
PostAttackDiscoveryBulkResponse400Example:
summary: Bad Request error returned when the bulk update payload is invalid.
value:
error: Bad Request
message: Invalid request parameters.
status_code: 400
schema:
type: object
properties:
error:
description: Error type
example: Bad Request
type: string
message:
description: Human-readable error message describing what went wrong with the bulk update request
example: Invalid request parameters.
type: string
status_code:
description: HTTP status code
example: 400
type: number
required:
- status_code
- error
- message
description: Bad Request response.
summary: Bulk update Attack discoveries
tags:
- Security Attack discovery API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_bulk' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data-raw '{\n \"update\": {\n \"ids\": [\n \"c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f\",\n \"5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7\"\n ],\n \"kibana_alert_workflow_status\": \"acknowledged\"\n }\n }'\n"
x-metaTags:
- content: Kibana
name: product_name
/api/attack_discovery/_find:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/attack_discovery/_find</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.'
operationId: AttackDiscoveryFind
parameters:
- description: Filter results to Attack discoveries that include any of the provided alert IDs
in: query
name: alert_ids
required: false
schema:
items:
type: string
type: array
- description: Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from `connector_id` values used to generate Attack discoveries.
in: query
name: connector_names
required: false
schema:
items:
type: string
type: array
- description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
example: false
in: query
name: enable_field_rendering
required: false
schema:
default: false
type: boolean
- description: End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
example: now
in: query
name: end
required: false
schema:
type: string
- description: Filter results to the Attack discoveries with the specified IDs
in: query
name: ids
required: false
schema:
items:
type: string
type: array
- description: If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries
example: false
in: query
name: include_unique_alert_ids
required: false
schema:
type: boolean
- description: Page number to return (used for pagination). Defaults to 1.
example: 1
in: query
name: page
required: false
schema:
default: 1
minimum: 1
type: integer
- description: Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
example: 10
in: query
name: per_page
required: false
schema:
default: 10
minimum: 1
type: integer
- description: Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
example: ''
in: query
name: search
required: false
schema:
type: string
- description: Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user.
in: query
name: shared
required: false
schema:
type: boolean
- description: Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.
in: query
name: scheduled
required: false
schema:
type: boolean
- description: Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.
example: '@timestamp'
in: query
name: sort_field
required: false
schema:
$ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryFindSortField'
default: '@timestamp'
- description: Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.
example: desc
in: query
name: sort_order
required: false
schema:
$ref: '#/components/schemas/Security_Attack_discovery_API_SortOrder'
default: desc
- description: Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
example: now-24h
in: query
name: start
required: false
schema:
type: string
- description: Filter by alert workflow status. Provide one or more of the allowed workflow states.
example:
- open
- acknowledged
in: query
name: status
required: false
schema:
items:
enum:
- acknowledged
- closed
- open
type: string
type: array
- description: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.
example: true
in: query
name: with_replacements
required: false
schema:
default: true
type: boolean
responses:
'200':
content:
application/json:
examples:
AttackDiscoveryFindResponse200Example:
summary: Paginated list of Attack discoveries matching the search criteria.
value:
connector_names:
- GPT-5 Chat
data:
- connector_name: GPT-5 Chat
id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
title: Suspicious process execution on host-01
page: 1
per_page: 10
total: 1
unique_alert_ids_count: 0
schema:
type: object
properties:
connector_names:
description: List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
items:
type: string
type: array
data:
description: Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema.
items:
$ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
type: array
page:
description: Current page number of the paginated result set.
type: integer
per_page:
description: Number of items requested per page.
type: integer
total:
description: Total number of Attack discoveries matching the query (across all pages).
type: integer
unique_alert_ids:
description: List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
items:
type: string
type: array
unique_alert_ids_count:
description: Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
type: integer
required:
- connector_names
- data
- page
- per_page
- total
- unique_alert_ids_count
description: Indicates a successful call.
'400':
content:
application/json:
examples:
AttackDiscoveryFindResponse400Example:
summary: Bad Request error returned when find query parameters are invalid.
value:
error: Bad Request
message: Invalid request payload.
status_code: 400
schema:
type: object
properties:
error:
description: Error type
example: Bad Request
type: string
message:
description: Human-readable error message
example: Invalid request payload.
type: string
status_code:
description: HTTP status code
example: 400
type: number
description: Bad Request response.
summary: Find Attack discoveries that match the search criteria
tags:
- Security Attack discovery API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/_find?end=now&include_unique_alert_ids=false&page=1&per_page=10&search=&sort_field=%40timestamp&sort_order=desc&start=now-24h&status=open&status=acknowledged' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/attack_discovery/_generate:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/attack_discovery/_generate</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.'
operationId: PostAttackDiscoveryGenerate
requestBody:
content:
application/json:
examples:
PostAttackDiscoveryGenerateRequestBodyExample:
summary: Generate Attack discoveries from alerts in the last 24 hours.
value:
alertsIndexPattern: .alerts-security.alerts-default
anonymizationFields:
- allowed: true
anonymized: true
field: host.name
- allowed: true
anonymized: true
field: user.name
- allowed: true
anonymized: false
field: process.name
apiConfig:
actionTypeId: .gen-ai
connectorId: 12345678-1234-1234-1234-123456789012
connectorName: GPT-5 Chat
end: now
replacements: {}
size: 100
start: now-24h
subAction: invokeAI
schema:
$ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenerationConfig'
required: true
responses:
'200':
content:
application/json:
examples:
PostAttackDiscoveryGenerateResponse200Example:
summary: Generation started; use the returned execution UUID to track progress.
value:
execution_uuid: edd26039-0990-4d9f-9829-2a1fcacb77b5
schema:
type: object
properties:
execution_uuid:
$ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
description: The unique identifier for the attack discovery generation process. Use this UUID to track the generation progress and retrieve results via the find endpoint.
example: edd26039-0990-4d9f-9829-2a1fcacb77b5
required:
- execution_uuid
description: Indicates a successful call.
'400':
content:
application/json:
examples:
PostAttackDiscoveryGenerateResponse400Example:
summary: Bad Request error returned when the generate payload is invalid.
value:
error: Bad Request
message: Invalid request parameters.
status_code: 400
schema:
type: object
properties:
error:
description: Error type
example: Bad Request
type: string
message:
description: Human-readable error message describing what went wrong
example: Invalid request parameters.
type: string
status_code:
description: HTTP status code
example: 400
type: number
required:
- status_code
- error
- message
description: Bad Request response.
summary: Generate attack discoveries from alerts
tags:
- Security Attack discovery API
x-codeSamples:
- label: Example request
lang: curl
source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_generate' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n \"alertsIndexPattern\": \".alerts-security.alerts-default\",\n \"anonymizationFields\": [\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"@timestamp\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"aKiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.feature\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"saiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.data\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"sqiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.entropy\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"s6iJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.extension\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"tKiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.metrics\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"taiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.operation\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"tqiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.path\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"t6iJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.files.score\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"uKiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"Ransomware.version\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"uaiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"_id\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"Z6iJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"agent.id\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"aaiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"cloud.availability_zone\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"aqiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"cloud.provider\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"a6iJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"cloud.region\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"bKiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"destination.ip\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"baiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"dns.question.name\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"bqiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"dns.question.type\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"b6iJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"event.category\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"cKiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"event.dataset\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"caiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"event.module\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"cqiJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"event.outcome\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"c6iJW5gB4U27o8XO8oLf\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"file.Ext.original.path\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"dKiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"file.hash.sha256\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"daiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"file.name\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"dqiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"file.path\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"d6iJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"group.id\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\n \"id\": \"eKiJW5gB4U27o8XO8oLg\"\n },\n {\n \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n \"field\": \"group.name\",\n \"allowed\": true,\n \"anonymized\": false,\n \"namespace\": \"default\",\
# --- truncated at 32 KB (123 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-security-attack-discovery-api-api-openapi.yml