---
type: api
title: Security Osquery
description: Run live queries, manage packs and saved queries.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/group/endpoint-security-osquery-api
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/group/endpoint-security-osquery-api
products:
  - Kibana
---

# Security Osquery

`Security Osquery API`

Run live queries, manage packs and saved queries.

- [Get unified query history](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetunifiedhistory): `GET` `/api/osquery/history`, `GET` `/s/{space_id}/api/osquery/history`
- [Get live queries](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryfindlivequeries): `GET` `/api/osquery/live_queries`, `GET` `/s/{space_id}/api/osquery/live_queries`
- [Create a live query](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerycreatelivequery): `POST` `/api/osquery/live_queries`, `POST` `/s/{space_id}/api/osquery/live_queries`
- [Get live query details](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetlivequerydetails): `GET` `/api/osquery/live_queries/{id}`, `GET` `/s/{space_id}/api/osquery/live_queries/{id}`
- [Get live query results](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetlivequeryresults): `GET` `/api/osquery/live_queries/{id}/results/{actionId}`, `GET` `/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}`
- [Export live query results](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryexportlivequeryresults): `POST` `/api/osquery/live_queries/{id}/results/{actionId}/_export`, `POST` `/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}/_export`
- [Get packs](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryfindpacks): `GET` `/api/osquery/packs`, `GET` `/s/{space_id}/api/osquery/packs`
- [Create a pack](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerycreatepacks): `POST` `/api/osquery/packs`, `POST` `/s/{space_id}/api/osquery/packs`
- [Delete a pack](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerydeletepacks): `DELETE` `/api/osquery/packs/{id}`, `DELETE` `/s/{space_id}/api/osquery/packs/{id}`
- [Get pack details](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetpacksdetails): `GET` `/api/osquery/packs/{id}`, `GET` `/s/{space_id}/api/osquery/packs/{id}`
- [Update a pack](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryupdatepacks): `PUT` `/api/osquery/packs/{id}`, `PUT` `/s/{space_id}/api/osquery/packs/{id}`
- [Copy a pack](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerycopypacks): `POST` `/api/osquery/packs/{id}/copy`, `POST` `/s/{space_id}/api/osquery/packs/{id}/copy`
- [Get saved queries](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryfindsavedqueries): `GET` `/api/osquery/saved_queries`, `GET` `/s/{space_id}/api/osquery/saved_queries`
- [Create a saved query](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerycreatesavedquery): `POST` `/api/osquery/saved_queries`, `POST` `/s/{space_id}/api/osquery/saved_queries`
- [Delete a saved query](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerydeletesavedquery): `DELETE` `/api/osquery/saved_queries/{id}`, `DELETE` `/s/{space_id}/api/osquery/saved_queries/{id}`
- [Get saved query details](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetsavedquerydetails): `GET` `/api/osquery/saved_queries/{id}`, `GET` `/s/{space_id}/api/osquery/saved_queries/{id}`
- [Update a saved query](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryupdatesavedquery): `PUT` `/api/osquery/saved_queries/{id}`, `PUT` `/s/{space_id}/api/osquery/saved_queries/{id}`
- [Copy a saved query](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerycopysavedquery): `POST` `/api/osquery/saved_queries/{id}/copy`, `POST` `/s/{space_id}/api/osquery/saved_queries/{id}/copy`
- [Get scheduled action results](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetscheduledactionresults): `GET` `/api/osquery/scheduled_results/{scheduleId}/{executionCount}`, `GET` `/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}`
- [Export scheduled query results](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryexportscheduledqueryresults): `POST` `/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export`, `POST` `/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export`
- [Get scheduled query results](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osquerygetscheduledqueryresults): `GET` `/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results`, `GET` `/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results`