stack kb security-osquery-api osquery-update-packs cli command

Auth required Idempotent Scope: global

elastic stack kb security-osquery-api osquery-update-packs --id <id> [options]

Update a pack

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--id string required: The id parameter
--description string: The pack description.
--[no-]enabled: Enables the pack.
--name string: The pack name.
--policy-ids string[]: A list of agents policy IDs.
--queries string: An object of queries.
--shards string: An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
--input-file string: path to a JSON file to use as command input
--[no-]dry-run: validate all inputs and exit without performing any action (preview changes without applying them)