Grant access to Attack Discovery
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
Generally available
Attack Discovery requires specific Kibana feature privileges and, in most versions, index privileges on Attack Discovery alert indices. Some capabilities also require Workflows privileges.
After you grant the right access, choose how to run Attack Discovery.
Your role needs these Kibana privileges for the Security features in your version:
| Available in | Privileges |
|---|---|
| The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. | All for Attack discovery, and at least Read for Rules and Exceptions and Alerts |
| The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available in 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. | All for Security > Attack discovery, and at least Read for Security > Rules, Alerts, and Exceptions |
| The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available from 9.1 to 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. | All for Security > Attack discovery, and at least Read for Security |
| The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available in 9.0 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. | All for Security > Attack discovery |
For details on Attack discovery sub-feature privileges, refer to Attack discovery sub-feature privileges.
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
9.1+
Generally available since 9.1
Your role needs the appropriate index privileges based on what it must do with Attack Discovery alerts. Replace <space-id> with the Kibana space ID.
Your role needs the Elasticsearch privileges read and view_index_metadata on these indices:
.alerts-security.attack.discovery.alerts-<space-id>.internal.alerts-security.attack.discovery.alerts-<space-id>.adhoc.alerts-security.attack.discovery.alerts-<space-id>.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>
Your role needs the Elasticsearch privileges read, view_index_metadata, write, and maintenance on these indices to generate discoveries manually or with schedules, share manually created alerts with other users, and update a discovery's status:
.alerts-security.attack.discovery.alerts-<space-id>.internal.alerts-security.attack.discovery.alerts-<space-id>.adhoc.alerts-security.attack.discovery.alerts-<space-id>.internal.adhoc.alerts-security.attack.discovery.alerts-<space-id>
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
9.5+
Generally available since 9.5
When you turn on securitySolution:enableAttackDiscoveryWorkflows, your role also needs Analytics > Workflows privileges. Serverless roles include that access by default. On self-managed and Elastic Cloud Hosted deployments, add it to custom roles.
| Attack Discovery action | Workflows privilege needed |
|---|---|
| Monitor runs in Generations and open workflow execution details | read for Analytics → Workflows |
| Generate discoveries (manual or scheduled) | read and execute for Analytics → Workflows |
| Create, edit, or enable schedules | read and execute for Analytics → Workflows, plus Schedules → Allow changes |
| Deactivate or delete schedules | Schedules → Allow changes only |
Granting All for Analytics → Workflows includes read and execute. For finer-grained access, use Workflows sub-feature privileges.