Update Attack Discovery schedule

Base URL
https://{kibana_url}
  • PUT /api/attack_discovery/schedules/{id}
Auth

Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.

Path parameters

id string · format: nonempty · min length: 1 required

The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.

Example: 12345678-1234-1234-1234-123456789012

Request body

Updated Attack Discovery schedule configuration. All fields are required as this replaces the entire schedule configuration.

actions union oneOf[] required

The Attack Discovery schedule actions

One of:
action_type_id string required

The action type used for sending notifications.

alerts_filter object
group string required

Groups actions by use cases. Use default for alert notifications.

id string required

The connector ID.

params object required

Object containing the allowed connector fields, which varies according to the connector type.

uuid string · format: nonempty · min length: 1

A string that does not contain only whitespace characters.

name string required

The name of the schedule

params object required

An Attack Discovery schedule params

alerts_index_pattern string required

The index pattern to get alerts from

api_config object required

LLM API configuration.

actionTypeId string required

Action type ID

connectorId string required

Connector ID

defaultSystemPromptId string

Default system prompt ID

model string

Model

provider enum

Provider

Values: OpenAI Azure OpenAI Other
name string required

The name of the connector

combined_filter object
end string
filters object[]

The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.

size number required
start string
schedule object required
interval string required

The schedule interval

Responses

Successfully updated Attack Discovery schedule with the new configuration and metadata

application/json
actions union oneOf[] required

The Attack Discovery schedule actions

Same options as actions
created_at string · format: date-time required

The date the schedule was created

created_by string required

The name of the user that created the schedule

enabled boolean required

Indicates whether the schedule is enabled

id string required

UUID of Attack Discovery schedule

name string required

The name of the schedule

params object required

An Attack Discovery schedule params

Same fields as params
schedule object required
interval string required

The schedule interval

updated_at string · format: date-time required

The date the schedule was updated

updated_by string required

The name of the user that updated the schedule

Base URL
https://{kibana_url}