Get agent policies
https://{kibana_url}
- GET /api/fleet/agent_policies
- GET /s/{space_id}/api/fleet/agent_policies
Refer to Spaces for more information.
List all agent policies.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
Query Parameters
-
pagenumber Page number
-
perPagenumber Number of results per page
-
sortFieldstring Field to sort results by
-
showUpgradeableboolean When true, only show policies with upgradeable agents
-
kuerystring A KQL query string to filter results
-
showAgentlessboolean · default: true When false, exclude managed integration policies from the results. To manage these policies, use the managed integrations APIs.
-
noAgentCountboolean use withAgentCount instead
-
withAgentCountboolean get policies with agent count
-
fullboolean get full policies with package policies populated
Responses
Successful response
-
itemsobject · max: 10000required -
advanced_settingsobject -
agent_download_timeoutobject -
agent_internalobject -
agent_limits_go_max_procsobject -
agent_logging_files_intervalobject -
agent_logging_levelobject -
agent_logging_metrics_periodobject -
agent_logging_to_filesobject -
agent_featuresobject · max: 100 -
agentlessobject -
cloud_connectorsobject -
enabledbooleanrequired -
target_csp -
Values:
awsazuregcp -
cluster_idstring -
agentsnumber -
agents_per_versionobject · max: 1000 -
created_atstring -
data_output_idstringnullable -
descriptionstring -
download_source_idstringnullable deprecated -
Use
download_source_idsinstead -
download_source_idsstring · max: 3 -
fips_agentsnumber -
fleet_server_host_idstringnullable -
User defined data tags that are added to all of the inputs. The values can be strings or numbers.
-
has_agent_version_conditionsboolean -
has_fleet_serverboolean -
idstringrequired -
inactivity_timeoutnumber · min: 0 · default: 1209600 -
is_defaultboolean -
is_default_fleet_serverboolean -
is_managedboolean -
is_preconfiguredboolean -
is_protectedbooleanrequired -
Indicates whether the agent policy has tamper protection enabled. Defaults to
false. -
is_verifierboolean -
keep_monitoring_alivebooleannullable -
When set to true, monitoring will be enabled but logs/metrics collection will be disabled
-
min_agent_versionstringnullable -
monitoring_diagnosticsobject -
monitoring_enabled· max: 3 -
Values:
logsmetricstraces -
monitoring_httpobject -
monitoring_output_idstringnullable -
monitoring_pprof_enabledboolean -
namestring · min: 1required -
namespacestring · min: 1required -
overridesmap string to objectnullable -
Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
-
package_agent_version_conditionsobject · max: 1000nullable -
namestringrequired -
titlestringrequired -
version_conditionstringrequired -
package_policiesanyOf -
additional_datastreams_permissionsstring · max: 1000nullable -
Additional data stream permissions that will be added to the agent policy.
-
agentsnumber -
cloud_connector_idstringnullable -
ID of the cloud connector associated with this package policy.
-
cloud_connector_namestring · min: 1 · max: 255nullable -
Transient field for cloud connector name during creation.
-
conditionstring · max: 10000nullable -
Agent condition expression to evaluate whether to apply this integration to its inputs.
-
created_atstringrequired -
created_bystringrequired -
descriptionstring -
Package policy description
-
elasticsearchobject -
privilegesobject -
clusterstring · max: 100 -
enabledbooleanrequired -
The name of the custom field. Cannot contain spaces.
-
The value of the custom field.
-
idstringrequired -
Package policy unique identifier.
-
inputsanyOfrequired -
Package policy inputs.
-
compiled_inputobjectrequired -
conditionstring · max: 10000nullable -
Agent condition expression to evaluate whether to apply this input.
-
configmap string to object -
Package variable (see integration documentation for more information)
-
deprecated -
descriptionstring · max: 4096required -
replaced_bymap string to string -
sincestring · max: 50 -
enabledbooleanrequired -
idstring -
keep_enabledboolean -
migrate_fromstring -
namestring -
policy_templatestring -
streamsobject · max: 1000required -
compiled_streamobjectrequired -
conditionstring · max: 10000nullable -
Agent condition expression to evaluate whether to apply this stream.
-
configmap string to object -
Package variable (see integration documentation for more information)
-
data_streamobjectrequired -
datasetstringrequired -
elasticsearchobject -
dynamic_datasetboolean -
dynamic_namespaceboolean -
privilegesobject -
indicesstring · max: 100 -
typestring -
deprecated -
descriptionstring · max: 4096required -
replaced_bymap string to string -
sincestring · max: 50 -
enabledbooleanrequired -
idstring -
keep_enabledboolean -
migrate_fromstring -
release -
Values:
gabetaexperimental -
var_group_selectionsmap string to string -
Variable group selections. Maps var_group name to the selected option name within that group.
-
typestringrequired -
var_group_selectionsmap string to string -
Variable group selections. Maps var_group name to the selected option name within that group.
-
<string>object -
conditionstring · max: 10000nullable -
Agent condition expression to evaluate whether to apply this input.
-
deprecated -
descriptionstring · max: 4096required -
replaced_bymap string to string -
sincestring · max: 50 -
enabledboolean -
Enable or disable that input. Defaults to
true(enabled). -
streamsmap string to object -
Input streams. Refer to the integration documentation to know which streams are available.
-
<string>object -
conditionstring · max: 10000nullable -
Agent condition expression to evaluate whether to apply this stream.
-
deprecated -
descriptionstring · max: 4096required -
replaced_bymap string to string -
sincestring · max: 50 -
enabledboolean -
Enable or disable that stream. Defaults to
true(enabled). -
var_group_selectionsmap string to string -
Variable group selections. Maps var_group name to the selected option name within that group.
-
varsmap string to anyOf -
Input/stream level variable. Refer to the integration documentation for more information.
-
varsmap string to anyOf -
Input/stream level variable. Refer to the integration documentation for more information.
-
is_managedboolean -
namestringrequired -
Unique name for the package policy.
-
namespacestring · max: 100 -
The package policy namespace. Leave blank to inherit the agent policy's namespace.
-
output_idstringnullable -
overridesobjectnullable -
Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
-
inputsmap string to object -
package -
experimental_data_stream_featuresobject · max: 100 -
data_streamstring · max: 1024required -
featuresobjectrequired -
doc_value_only_numericboolean -
doc_value_only_otherboolean -
synthetic_sourceboolean -
tsdbboolean -
fips_compatibleboolean -
namestring · max: 255required -
Package name
-
requires_rootboolean -
titlestring · max: 255 -
versionstring · max: 50required -
Package version
-
policy_idstringnullable deprecated -
ID of the agent policy which the package policy will be added to.
-
policy_idsstring · max: 1000 -
revisionnumberrequired -
Package policy revision.
-
secret_referencesobject · max: 1000 -
idstringrequired -
spaceIdsstring · max: 100 -
supports_agentlessbooleannullable -
Indicates whether the package policy belongs to an agentless agent policy.
-
supports_cloud_connectorbooleannullable -
Indicates whether the package policy supports cloud connectors.
-
updated_atstringrequired -
updated_bystringrequired -
var_group_selectionsmap string to string -
Variable group selections. Maps var_group name to the selected option name within that group.
-
varsanyOf -
Package level variable.
-
versionstring -
Package policy ES version.
-
required_versionsobject · max: 100nullable -
percentagenumber · min: 0 · max: 100required -
Target percentage of agents to auto upgrade
-
versionstringrequired -
Target version for automatic agent upgrade
-
revisionnumberrequired -
schema_versionstring -
space_idsstring · max: 100 -
status -
Values:
activeinactive -
supports_agentlessbooleannullable -
Indicates whether the agent policy supports agentless integrations.
-
unenroll_timeoutnumber · min: 0 -
unprivileged_agentsnumber -
updated_atstringrequired -
updated_bystringrequired -
versionstring -
pagenumberrequired -
perPagenumberrequired -
totalnumberrequired
string
Kibana_HTTP_APIs_package_policy_response
object
Package policy inputs. Refer to the integration documentation to know which inputs are available.
Bad Request
-
attributesobjectrequired -
errorstring -
errorTypestring -
messagestringrequired -
statusCodenumber