stack kb security-attack-discovery-api attack-discovery-find cli command

elastic stack kb security-attack-discovery-api attack-discovery-find [options]

Find Attack discoveries that match the search criteria

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--alert-ids string[]

Filter results to Attack discoveries that include any of the provided alert IDs

Repeatable: pass --alert-ids multiple times to supply more than one value

--connector-names string[]

Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable connector_name property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from connector_id values used to generate Attack discoveries.

Repeatable: pass --connector-names multiple times to supply more than one value

--enable-field-rendering

Enables a markdown syntax used to render pivot fields, for example \{{ user.name james }}. When disabled, the same example would be rendered as james. This is primarily used for Attack Discovery views within Kibana. Defaults to false.

--end string

End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").

--ids string[]

Filter results to the Attack discoveries with the specified IDs

Repeatable: pass --ids multiple times to supply more than one value

--include-unique-alert-ids

If true, the response will include unique_alert_ids and unique_alert_ids_count aggregated across the matched Attack discoveries

--page number

Page number to return (used for pagination). Defaults to 1.

--per-page number

Number of Attack discoveries to return per page (used for pagination). Defaults to 10.

--search string

Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)

--shared

Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use true to return only shared discoveries, false to return only those visible to the current user. Mutually exclusive with include_all_authors.

--include-all-authors

If true, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with shared.

--scheduled

Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use true to return only scheduled discoveries or false to return only ad-hoc discoveries.

--sort-field enum

Field used to sort results. See AttackDiscoveryFindSortField for allowed values.

Values: @timestamp

--sort-order enum

Sort order direction asc for ascending or desc for descending. Defaults to desc.

Values: asc, desc

--start string

Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").

--status string[]

Filter by alert workflow status. Provide one or more of the allowed workflow states.

Repeatable: pass --status multiple times to supply more than one value

--with-replacements

When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON