Disable Attack Discovery schedule

Base URL: https://{kibana_url}

POST /api/attack_discovery/schedules/{id}/_disable

Auth

Disables an Attack Discovery schedule, preventing it from running according to its configured interval. The schedule configuration is preserved and can be re-enabled later. Any currently running executions will complete, but no new executions will be started.

Path parameters

id string · format: nonempty · min length: 1 required: The unique identifier (UUID) of the Attack Discovery schedule to disable. This ID is returned when creating a schedule and can be found in schedule listings.; Example: 12345678-1234-1234-1234-123456789012

Responses

Successfully disabled Attack Discovery schedule, returning the schedule ID for confirmation

application/json

id string · format: nonempty · min length: 1 required: A string that does not contain only whitespace characters.

Bad Request response.

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request curl 1 / 1 language

curl Shell

curl \
 --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_disable' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json"

Response

{
  "id": "12345678-1234-1234-1234-123456789012"
}

{
  "error": "Bad Request",
  "message": "Invalid request parameters.",
  "status_code": 400
}