Run Attack Discovery from the Attacks view
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
GA
9.5+
…
Generally available since 9.5
Preview in 9.4
From the Attacks view, configure which alerts to analyze, then start a manual or scheduled run. Discoveries appear in the same view next to their related alerts.
To use the Attacks view, you need:
- The
securitySolution:enableAlertsAndAttacksAlignmentadvanced setting turned on (only required for Elastic Stack 9.4). - The
securitySolution:enableAttackDiscoveryWorkflowsadvanced setting turned on if you want the settings flyout with skill, query, and workflow retrieval. - A configured LLM connector that uses a model recommended for Attack Discovery in the Large language model performance matrix, unless your subscription or project already includes an Elastic Managed LLM.
- A role with the index privileges required to generate and read discoveries, and these Kibana privileges at minimum:
- Security → Attack discovery:
All - Security → Rules and Exceptions:
Read - Security → Alerts:
Read
- Security → Attack discovery:
- Open the Attacks view at Detections → Views → Attacks.
- Configure Attack Discovery settings.
- Start Attack Discovery with a manual run or a scheduled run.
- Open the Attacks view at Detections → Views → Attacks.
- Configure which alerts to analyze when you create or edit a schedule (classic schedule flyout controls).
- Schedule runs from Attacks, or manually run Attack Discovery from the Attack Discovery page.