Generate attack discoveries from alerts | Kibana API documentation

Generate attack discoveries from alerts Technical Preview; added in 9.2.0

POST /api/attack_discovery/_generate

Spaces method and path for this operation:

post /s/{space_id}/api/attack_discovery/_generate

Refer to Spaces for more information.

Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint. Technical preview

application/json

Body Required

alertsIndexPattern string Required

The (space specific) index pattern that contains the alerts to use as context for the attack discovery. Example: .alerts-security.alerts-default
anonymizationFields array[object] Required

The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the /api/security_ai_assistant/anonymization_fields/_find API (for a specific Kibana space) to provide this value.
Hide anonymizationFields attributes Show anonymizationFields attributes object
- allowed boolean
  
  Whether this field is allowed to be sent to the model.
- anonymized boolean
  
  Whether this field should be anonymized.
- createdAt string
  
  Timestamp of when the anonymization field was created.
- createdBy string
  
  Username of the person who created the anonymization field.
- field string Required
  
  Name of the anonymization field.
- id string(nonempty) Required
  
  A string that does not contain only whitespace characters.
  
  Minimum length is 1.
- namespace string
  
  Kibana space in which this anonymization field exists.
- timestamp string(nonempty)
  
  A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
  
  Minimum length is 1.
- updatedAt string
  
  Timestamp of the last update.
- updatedBy string
  
  Username of the person who last updated the field.
apiConfig object Required
Hide apiConfig attributes Show apiConfig attributes object
- actionTypeId string Required
  
  Action type ID
- connectorId string Required
  
  Connector ID
- defaultSystemPromptId string
  
  Default system prompt ID
- model string
  
  Model
- provider string
  
  Provider
  
  Values are OpenAI, Azure OpenAI, or Other.
connectorName string
end string
filter object

An Elasticsearch-style query DSL object used to filter alerts. For example: json { "filter": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "term": { "user.name": { "value": "james" } } } ], "minimum_should_match": 1 } } ], "should": [], "must_not": [] } } }

Additional properties are allowed.
model string
replacements object

Replacements object used to anonymize/deanonymize messages
Hide replacements attribute Show replacements attribute object
- * string Additional properties
size number Required
start string
subAction string Required

Values are invokeAI or invokeStream.

Responses

200 application/json

Attack discovery generation initiated successfully
Hide response attribute Show response attribute object
- execution_uuid string(nonempty) Required
  
  A string that does not contain only whitespace characters.
  
  Minimum length is 1.
400 application/json

Bad request - Invalid input parameters or configuration
Hide response attributes Show response attributes object
- error string Required
  
  Error type
- message string Required
  
  Human-readable error message describing what went wrong
- status_code number Required
  
  HTTP status code

POST /api/attack_discovery/_generate

curl \ --request POST 'http://localhost:5601/api/attack_discovery/_generate' \ --header "Authorization: $API_KEY" \ --header "Content-Type: application/json" \ --data '{ "alertsIndexPattern": ".alerts-security.alerts-default", "anonymizationFields": [ { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "@timestamp", "allowed": true, "anonymized": false, "namespace": "default", "id": "aKiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.feature", "allowed": true, "anonymized": false, "namespace": "default", "id": "saiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.data", "allowed": true, "anonymized": false, "namespace": "default", "id": "sqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.entropy", "allowed": true, "anonymized": false, "namespace": "default", "id": "s6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.extension", "allowed": true, "anonymized": false, "namespace": "default", "id": "tKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.metrics", "allowed": true, "anonymized": false, "namespace": "default", "id": "taiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.operation", "allowed": true, "anonymized": false, "namespace": "default", "id": "tqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.path", "allowed": true, "anonymized": false, "namespace": "default", "id": "t6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.files.score", "allowed": true, "anonymized": false, "namespace": "default", "id": "uKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "Ransomware.version", "allowed": true, "anonymized": false, "namespace": "default", "id": "uaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "_id", "allowed": true, "anonymized": false, "namespace": "default", "id": "Z6iJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "agent.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "aaiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "cloud.availability_zone", "allowed": true, "anonymized": false, "namespace": "default", "id": "aqiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "cloud.provider", "allowed": true, "anonymized": false, "namespace": "default", "id": "a6iJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "cloud.region", "allowed": true, "anonymized": false, "namespace": "default", "id": "bKiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "destination.ip", "allowed": true, "anonymized": false, "namespace": "default", "id": "baiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "dns.question.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "bqiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "dns.question.type", "allowed": true, "anonymized": false, "namespace": "default", "id": "b6iJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "event.category", "allowed": true, "anonymized": false, "namespace": "default", "id": "cKiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "event.dataset", "allowed": true, "anonymized": false, "namespace": "default", "id": "caiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "event.module", "allowed": true, "anonymized": false, "namespace": "default", "id": "cqiJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "event.outcome", "allowed": true, "anonymized": false, "namespace": "default", "id": "c6iJW5gB4U27o8XO8oLf" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "file.Ext.original.path", "allowed": true, "anonymized": false, "namespace": "default", "id": "dKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "file.hash.sha256", "allowed": true, "anonymized": false, "namespace": "default", "id": "daiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "file.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "dqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "file.path", "allowed": true, "anonymized": false, "namespace": "default", "id": "d6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "group.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "eKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "group.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "eaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "host.asset.criticality", "allowed": true, "anonymized": false, "namespace": "default", "id": "eqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "host.name", "allowed": true, "anonymized": true, "namespace": "default", "id": "e6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "host.os.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "fKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "host.os.version", "allowed": true, "anonymized": false, "namespace": "default", "id": "faiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "host.risk.calculated_level", "allowed": true, "anonymized": false, "namespace": "default", "id": "fqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "host.risk.calculated_score_norm", "allowed": true, "anonymized": false, "namespace": "default", "id": "f6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.original_time", "allowed": true, "anonymized": false, "namespace": "default", "id": "gKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.risk_score", "allowed": true, "anonymized": false, "namespace": "default", "id": "gaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.description", "allowed": true, "anonymized": false, "namespace": "default", "id": "gqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "g6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.references", "allowed": true, "anonymized": false, "namespace": "default", "id": "hKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.framework", "allowed": true, "anonymized": false, "namespace": "default", "id": "haiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.tactic.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "hqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.tactic.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "h6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.tactic.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "iKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.technique.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "iaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.technique.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "iqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.technique.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "i6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.technique.subtechnique.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "jKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.technique.subtechnique.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "jaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.rule.threat.technique.subtechnique.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "jqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.severity", "allowed": true, "anonymized": false, "namespace": "default", "id": "j6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "kibana.alert.workflow_status", "allowed": true, "anonymized": false, "namespace": "default", "id": "kKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "message", "allowed": true, "anonymized": false, "namespace": "default", "id": "kaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "network.protocol", "allowed": true, "anonymized": false, "namespace": "default", "id": "kqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.Ext.memory_region.bytes_compressed_present", "allowed": true, "anonymized": false, "namespace": "default", "id": "nKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.Ext.memory_region.malware_signature.all_names", "allowed": true, "anonymized": false, "namespace": "default", "id": "naiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.Ext.memory_region.malware_signature.primary.matches", "allowed": true, "anonymized": false, "namespace": "default", "id": "nqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.Ext.memory_region.malware_signature.primary.signature.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "n6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.Ext.token.integrity_level_name", "allowed": true, "anonymized": false, "namespace": "default", "id": "oKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.args", "allowed": true, "anonymized": false, "namespace": "default", "id": "k6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.code_signature.exists", "allowed": true, "anonymized": false, "namespace": "default", "id": "lKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.code_signature.signing_id", "allowed": true, "anonymized": false, "namespace": "default", "id": "laiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.code_signature.status", "allowed": true, "anonymized": false, "namespace": "default", "id": "lqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.code_signature.subject_name", "allowed": true, "anonymized": false, "namespace": "default", "id": "l6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.code_signature.trusted", "allowed": true, "anonymized": false, "namespace": "default", "id": "mKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.command_line", "allowed": true, "anonymized": false, "namespace": "default", "id": "maiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.executable", "allowed": true, "anonymized": false, "namespace": "default", "id": "mqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.exit_code", "allowed": true, "anonymized": false, "namespace": "default", "id": "m6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.hash.md5", "allowed": true, "anonymized": false, "namespace": "default", "id": "oaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.hash.sha1", "allowed": true, "anonymized": false, "namespace": "default", "id": "oqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.hash.sha256", "allowed": true, "anonymized": false, "namespace": "default", "id": "o6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "pKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.args", "allowed": true, "anonymized": false, "namespace": "default", "id": "paiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.args_count", "allowed": true, "anonymized": false, "namespace": "default", "id": "pqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.code_signature.exists", "allowed": true, "anonymized": false, "namespace": "default", "id": "p6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.code_signature.status", "allowed": true, "anonymized": false, "namespace": "default", "id": "qKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.code_signature.subject_name", "allowed": true, "anonymized": false, "namespace": "default", "id": "qaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.code_signature.trusted", "allowed": true, "anonymized": false, "namespace": "default", "id": "qqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.command_line", "allowed": true, "anonymized": false, "namespace": "default", "id": "q6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.executable", "allowed": true, "anonymized": false, "namespace": "default", "id": "rKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.parent.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "raiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.pe.original_file_name", "allowed": true, "anonymized": false, "namespace": "default", "id": "rqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.pid", "allowed": true, "anonymized": false, "namespace": "default", "id": "r6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "process.working_directory", "allowed": true, "anonymized": false, "namespace": "default", "id": "sKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "rule.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "uqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "rule.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "u6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "source.ip", "allowed": true, "anonymized": false, "namespace": "default", "id": "vKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.framework", "allowed": true, "anonymized": false, "namespace": "default", "id": "vaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.tactic.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "vqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.tactic.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "v6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.tactic.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "wKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.technique.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "waiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.technique.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "wqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.technique.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "w6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.technique.subtechnique.id", "allowed": true, "anonymized": false, "namespace": "default", "id": "xKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.technique.subtechnique.name", "allowed": true, "anonymized": false, "namespace": "default", "id": "xaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "threat.technique.subtechnique.reference", "allowed": true, "anonymized": false, "namespace": "default", "id": "xqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "user.asset.criticality", "allowed": true, "anonymized": false, "namespace": "default", "id": "x6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "user.domain", "allowed": true, "anonymized": false, "namespace": "default", "id": "yKiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "user.name", "allowed": true, "anonymized": true, "namespace": "default", "id": "yaiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "user.risk.calculated_level", "allowed": true, "anonymized": false, "namespace": "default", "id": "yqiJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "user.risk.calculated_score_norm", "allowed": true, "anonymized": false, "namespace": "default", "id": "y6iJW5gB4U27o8XO8oLg" }, { "timestamp": "2025-07-30T13:33:44.029Z", "createdAt": "2025-07-30T13:33:44.029Z", "field": "user.target.name", "allowed": true, "anonymized": true, "namespace": "default", "id": "zKiJW5gB4U27o8XO8oLg" } ], "replacements": {}, "size": 100, "subAction": "invokeAI", "apiConfig": { "connectorId": "example-connector-id", "actionTypeId": ".gen-ai" }, "connectorName": "GPT-5 Chat", "end": "now", "start": "now-24h" }'