Query parameters

• end string

  End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").

• size number

  The maximum number of generations to retrieve

  Minimum value is 1. Default value is 50.

• scheduled boolean

  Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use true to return only scheduled generations or false to return only ad-hoc (interactive or action-triggered) generations.

• start string

  Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attribute Show response attribute object

  • generations array[object] Required

    List of Attack Discovery generations

    Hide generations attributes Show generations attributes object

    • alerts_context_count number

      The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation

    • connector_id string Required

      The connector id (event.dataset) for this generation

    • connector_stats object

      Stats applicable to the connector for this generation

      Hide connector_stats attributes Show connector_stats attributes object

      • average_successful_duration_nanoseconds number

        The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user

      • successful_generations number

        The number of successful generations for the same connector id, for the current user

    • conversation_id string

      Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)

    • discoveries number Required

      The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation

    • duplicates_dropped_count integer

      The number of attack discoveries dropped as duplicates during the persist step

    • end string

      When generation ended (max event.end)

    • error_category string

      Structured error category from server classification (optional; absent for successful generations)

    • execution_uuid string Required

      The unique identifier (kibana.alert.rule.execution.uuid) for the generation

    • failed_workflow_id string

      Workflow ID that caused the failure (optional; absent for successful generations)

    • generated_count integer

      The number of attack discoveries generated before deduplication and hallucination filtering

    • hallucinations_filtered_count integer

      The number of attack discoveries filtered as hallucinations during the validation step

    • loading_message string

      Generation loading message (kibana.alert.rule.execution.status)

    • persisted_count integer

      The number of attack discoveries successfully persisted after deduplication and hallucination filtering

    • reason string

      Reason for failed generations (event.reason)

    • source_metadata object | null

      Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)

      Hide source_metadata attributes Show source_metadata attributes object | null

      • action_execution_uuid string

        The action execution UUID from the alerting framework

      • rule_id string

        The ID of the alerting rule that triggered this generation

      • rule_name string

        The name of the alerting rule that triggered this generation

    • start string Required

      When generation started (min event.start)

    • status string Required

      The status of the attack discovery generation

      Values are canceled, dismissed, failed, started, or succeeded.

    • step_event_actions array[string]

      Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.

    • workflow_executions object

      Workflow execution tracking for alert retrieval, generation, and validation workflows

      Hide workflow_executions attributes Show workflow_executions attributes object

      • alertRetrieval array[object] | null

        Alert retrieval workflow executions (one per workflow invoked)

        Hide alertRetrieval attributes Show alertRetrieval attributes object

        • workflowId string Required

          The workflow definition ID

        • workflowName string

          The human-readable workflow name (optional; used by the UI to display a label)

        • workflowRunId string Required

          The workflow execution ID

      • gate array[object] | null

        Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers

        Hide gate attributes Show gate attributes object

        • workflowId string Required

          The workflow definition ID

        • workflowName string

          The human-readable workflow name (optional; used by the UI to display a label)

        • workflowRunId string Required

          The workflow execution ID

      • generation object
        Hide generation attributes Show generation attributes object

        • workflowId string Required

          The workflow definition ID

        • workflowName string

          The human-readable workflow name (optional; used by the UI to display a label)

        • workflowRunId string Required

          The workflow execution ID

      • validation object
        Hide validation attributes Show validation attributes object

        • workflowId string Required

          The workflow definition ID

        • workflowName string

          The human-readable workflow name (optional; used by the UI to display a label)

        • workflowRunId string Required

          The workflow execution ID

    • workflow_id string

      The workflow definition ID for deep linking

    • workflow_run_id string

      The workflow execution ID for monitoring

• 400 application/json

  Bad Request response.

  Hide response attributes Show response attributes object

  • error string

    Error type

  • message string

    Human-readable error message

  • status_code number

    HTTP status code