stack kb security-attack-discovery-api get-attack-discovery-generation cli command

Auth required Idempotent Scope: global

elastic stack kb security-attack-discovery-api get-attack-discovery-generation \
  --execution-uuid <execution-uuid> \
  [options]

Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--execution-uuid string required: The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.
--enable-field-rendering: Enables a markdown syntax used to render pivot fields, for example \{{ user.name james }}. When disabled, the same example would be rendered as james. This is primarily used for Attack Discovery views within Kibana. Defaults to false.
--with-replacements: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to true.
--input-file string: path to a JSON file to use as command input
--dry-run: validate all inputs and exit without performing any action (preview changes without applying them)
--no-validate: skip input validation and send the request as-is

--output-fields string: comma-separated list of fields to include in output (dot-notation supported)
--output-template string: Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")
--json: output as JSON