stack kb security-osquery-api osquery-update-packs cli command

elastic stack kb security-osquery-api osquery-update-packs --id <id> [options]
		

Update a pack

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--id string required

The pack ID.

--description string

--enabled

--interval number

--min-osquery-version string

--name string

--platform string

--policy-ids string[]

Repeatable: pass --policy-ids multiple times to supply more than one value

--queries string

--result-type enum

Values: snapshot, differential, differential_added_only

--rrule-schedule string

--schedule-type enum

Values: interval, rrule

--shards string

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON