Skip to content

Commit 24dd74a

Browse files
[Security] Attack Discovery scheduling and saved discoveries
1 parent a5340bb commit 24dd74a

File tree

2 files changed

+67
-10
lines changed

2 files changed

+67
-10
lines changed
-115 KB
Loading

solutions/security/ai/attack-discovery.md

Lines changed: 67 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ mapped_pages:
33
- https://www.elastic.co/guide/en/security/current/attack-discovery.html
44
- https://www.elastic.co/guide/en/serverless/current/attack-discovery.html
55
applies_to:
6-
stack: preview
6+
stack: ga
77
serverless:
8-
security: preview
8+
security: ga
99
products:
1010
- id: security
1111
- id: cloud-serverless
@@ -20,13 +20,6 @@ For a demo, refer to the following video (click to view).
2020
[![Attack Discovery video](https://play.vidyard.com/eT92arEbpRddmSM4JeyzdX.jpg)](https://videos.elastic.co/watch/eT92arEbpRddmSM4JeyzdX?)
2121

2222

23-
This page describes:
24-
25-
* [How to generate discoveries](/solutions/security/ai/attack-discovery.md#attack-discovery-generate-discoveries)
26-
* [What information each discovery includes](/solutions/security/ai/attack-discovery.md#attack-discovery-what-info)
27-
* [How you can interact with discoveries to enhance {{elastic-sec}} workflows](/solutions/security/ai/attack-discovery.md#attack-discovery-workflows)
28-
29-
3023
## Role-based access control (RBAC) for Attack Discovery [attack-discovery-rbac]
3124

3225
You need the `Attack Discovery: All` privilege to use Attack Discovery.
@@ -54,7 +47,7 @@ Attack Discovery is designed for use with alerts based on data that complies wit
5447
The selected fields can now be analyzed the next time you run Attack Discovery.
5548
:::
5649

57-
## Generate discoveries [attack-discovery-generate-discoveries]
50+
## Generate discoveries manually[attack-discovery-generate-discoveries]
5851

5952
You’ll need to select an LLM connector before you can analyze alerts. Attack Discovery uses the same LLM connectors as [AI Assistant](/solutions/security/ai/ai-assistant.md). To get started:
6053

@@ -106,3 +99,67 @@ There are several ways you can incorporate discoveries into your {{elastic-sec}}
10699
:::{image} /solutions/images/security-add-discovery-to-assistant.gif
107100
:alt: Attack Discovery view in AI Assistant
108101
:::
102+
103+
## Schedule discoveries
104+
105+
```yaml {applies_to}
106+
stack: ga 9.1
107+
serverless: ga
108+
```
109+
110+
You can define recurring schedules (for example, daily or weekly) to automatically generate attack discoveries without needing manual runs. For example, you can generate discoveries every 24 hours and send a Slack notification to your SecOps channel if discoveries are found. Notifications are sent using configured [connectors](/deploy-manage/manage-connectors.md), such as Slack or email, and you can customize the notification content to tailor alert context to your needs.
111+
112+
Scheduled discoveries are shared by default with all users in a {{kib}} space.
113+
114+
:::{note}
115+
You can still generate discoveries manually at any time, regardless of an active schedule.
116+
:::
117+
118+
To create a new schedule:
119+
120+
1. Click the gear icon to open the settings menu, then select **Schedule**.
121+
2. Select **Create new schedule**.
122+
3. Enter a name for the new schedule.
123+
4. Select the LLM connector to use for generating discoveries, or add a new one.
124+
5. Use the KQL query bar, time filter, and alerts slider to customize the set of alerts that will be analyzed.
125+
6. Define the schedule's frequency (for example, every 24 hours).
126+
7. Optionally, select the [connectors](/deploy-manage/manage-connectors.md) to use for receiving notifications, and define their actions.
127+
8. Click **Create & enable schedule**.
128+
129+
After creating new schedules, you can view their status, modify them or delete them from the **Schedule** tab in the settings menu.
130+
131+
:::{tip}
132+
Scheduled discoveries are shown with a **Scheduled Attack discovery** icon ({icon}`calendar`). Click the icon to view the schedule that created it.
133+
:::
134+
135+
## View saved discoveries
136+
137+
```yaml {applies_to}
138+
stack: ga 9.1
139+
serverless: ga
140+
```
141+
142+
Attack discoveries are automatically saved each time you generate them. Once saved, discoveries remain available for later review, reporting, and tracking over time. This allows you to revisit discoveries to monitor trends, maintain audit trails, and support investigations as your environment evolves.
143+
144+
### Change a discovery's status
145+
146+
You can set a discovery's status to indicate that it's under active investigation or that it's been resolved. To do this, click **Take action**, then select **Mark as acknowledged** or **Mark as closed**.
147+
148+
### Take bulk actions
149+
150+
You can take bulk actions on multiple discoveries, such as bulk-changing their status or adding them to a case. To do this, select the checkboxes next to each discovery, then click **Selected *x* Attack discoveries** and choose the action you want to take.
151+
152+
### Search and filter saved discoveries
153+
154+
You can search and filter saved discoveries to help locate relevant findings.
155+
156+
* Use the search box to perform full-text searches across your generated discoveries.
157+
158+
* **Visibility**: Use this filter to, for example, show only shared discoveries.
159+
160+
* **Status**: Filter discoveries by their current status.
161+
162+
* **Connector**: Filter discoveries by connector name. Connectors that are deleted after discoveries have been generated are shown with a **Deleted** tag.
163+
164+
* Time filter: Adjust the time filter to view discoveries generated within a specific timeframe.
165+

0 commit comments

Comments
 (0)