[Internal]: Attack Discovery schedule bulk actions docs

[e40pud]

Description

We are adding bulk actions for Attack Discovery schedules.

The primary goal of this enhancement is to make it easier for analysts and administrators to manage multiple Attack Discovery schedules at once. Today, users can enable, disable, or delete schedules one at a time from the schedule table. With this change, users will be able to select multiple schedules and perform these actions in bulk.

The product documentation should be updated in the Attack Discovery scheduling section: https://www.elastic.co/docs/solutions/security/ai/attack-discovery#schedule-discoveries

API docs impact

This feature introduces new public Attack Discovery schedule bulk action APIs:

• POST /api/attack_discovery/schedules/_bulk_enable
• POST /api/attack_discovery/schedules/_bulk_disable
• POST /api/attack_discovery/schedules/_bulk_delete

Prerequisites, privileges, feature flags

Users need the same Attack Discovery schedule management privileges currently required to create, edit, enable, disable, or delete schedules.

Suggested documentation updates

Update the Schedule discoveries section to mention that users can manage multiple schedules at once from the Attack discovery schedule flyout:

• Select one or more schedules from the schedules table.
• Use Bulk actions to enable selected disabled schedules.
• Use Bulk actions to disable selected enabled schedules.
• Use Bulk actions to delete selected schedules.
• Confirm that bulk delete requires confirmation before schedules are removed.

Also clarify that bulk actions apply only to explicitly selected schedules in the current table selection.

Screenshots and recording

Screen.Recording.2026-05-04.at.17.36.29.mov

Resources

• Feature issue: [Security Solution] Add bulk actions for Attack Discovery schedules kibana#266760
• Docs section to update: https://www.elastic.co/docs/solutions/security/ai/attack-discovery#schedule-discoveries

Which deployment methods does this change impact?

Unknown

Feature differences

No response

What Elastic Stack release is this request related to?

9.5

Serverless release

Week of May 18, 2026

Collaboration model

Unknown

Point of contact.

Main contact: @e40pud

Stakeholders: @cthulhusec

[github-actions]

Elastic Docs AI Menu

Check one box to run an AI workflow for this issue.

• Triage (docs-triage). Status: not started.
• Scope the docs work (docs-issue-scope). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.