stack kb security-osquery-api osquery-update-saved-query cli command

Auth required Idempotent Scope: global

		elastic stack kb security-osquery-api osquery-update-saved-query \
  --id <id> \
  [options]
		
	

Update a saved query

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--id string required: The id parameter
--description string: The saved query description.
--ecs-mapping string: Map osquery results columns or static values to Elastic Common Schema (ECS) fields
--body-id string: The ID of a saved query.
--interval string: An interval, in seconds, on which to run the query.
--platform string: Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
--query string: The SQL query you want to run.
--[no-]removed: Indicates whether the query is removed.
--[no-]snapshot: Indicates whether the query is a snapshot.
--kb-version string: Uses the Osquery versions greater than or equal to the specified version string.
--input-file string: path to a JSON file to use as command input
--[no-]dry-run: validate all inputs and exit without performing any action (preview changes without applying them)