stack kb security-osquery-api osquery-get-unified-history cli command

elastic stack kb security-osquery-api osquery-get-unified-history [options]
		

Get unified query history

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--page-size number

The number of results to return per page.

--next-page string

A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.

--kuery string

A search string to filter history entries by pack name, query text, or query ID.

--user-ids string

Comma-separated list of user IDs to filter live query history.

--source-filters string

Comma-separated list of source types to include. Valid values are live, rule, and scheduled.

--start-date string

The start of the time range filter (ISO 8601).

--end-date string

The end of the time range filter (ISO 8601).

--input-file string

path to a JSON file to use as command input

--[no-]dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--[no-]json

output as JSON