stack kb security-osquery-api osquery-get-live-query-results cli command

elastic stack kb security-osquery-api osquery-get-live-query-results \
  --id <id> \
  --action-id <action-id> \
  [options]
		

Get live query results

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--id string required

The ID of the live query.

--action-id string required

The ID of the query action.

--kuery string

A KQL search string to filter results.

--page string

The page number to return.

--page-size string

The number of results to return per page.

--sort string

The field to sort results by.

--sort-order enum

The sort order.

Values: asc, desc

--input-file string

path to a JSON file to use as command input

--[no-]dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--[no-]json

output as JSON