stack kb security-osquery-api osquery-create-packs cli command

Auth required

elastic stack kb security-osquery-api osquery-create-packs [options]

Create a pack

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

Options

--description string: The pack description.
--[no-]enabled: Enables the pack.
--name string: The pack name.
--policy-ids string[]: A list of agents policy IDs.
--queries string: An object of queries.
--shards string: An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
--input-file string: path to a JSON file to use as command input
--[no-]dry-run: validate all inputs and exit without performing any action (preview changes without applying them)