stack kb security-attack-discovery-api post-attack-discovery-generate cli command

Auth required

elastic stack kb security-attack-discovery-api post-attack-discovery-generate \
  --alerts-index-pattern <alerts-index-pattern> \
  --anonymization-fields <anonymization-fields> \
  --api-config <api-config> \
  --size <size> \
  --sub-action <sub-action> \
  [options]

Generate attack discoveries from alerts

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--alerts-index-pattern string required

The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default

--anonymization-fields string[] required

The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the /api/security_ai_assistant/anonymization_fields/_find API (for a specific Kibana space) to provide this value.

Repeatable: pass --anonymization-fields multiple times to supply more than one value

--api-config string required

LLM API configuration.

--size number required

--sub-action enum required

Values: invokeAI, invokeStream

--connector-name string

--end string

--filter string

An Elasticsearch-style query DSL object used to filter alerts. For example:

} ```

--model string

--replacements string

--start string

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

Global Options

--output-fields string: comma-separated list of fields to include in output (dot-notation supported)
--output-template string: Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")
--json: output as JSON