Create a pack

Server: https://{kibana_url}

POST /api/osquery/packs
POST /s/{space_id}/api/osquery/packs

Api key auth Basic auth

Refer to Spaces for more information.

Create a query pack.

Request

description string: The pack description.
enabled boolean: Enables the pack.
interval integer · min: 1: Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.
min_osquery_version string · min: 1 · max: 64 · pattern: ^\d+(\.\d+){0,2}$: Minimum osquery version required to run this pack or query. Formatted as a numeric version string, e.g. "5.10.0". Non-numeric values (e.g. "latest") are rejected.
name string: The pack name.
platform string · min: 1 · max: 256: Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.
policy_ids [] object: A list of agents policy IDs.
queries object: An object of queries.
result_type enum: Controls the result document type emitted by osquerybeat for this pack or query.

snapshot: Full table snapshot on every scheduled run (default).

differential: Rows added or removed since the previous run.

differential_added_only: Only rows added since the previous run (no removals).; Values: snapshot differential differential_added_only
rrule_schedule {}: RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.
schedule_type enum: Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.; Values: interval rrule
shards object: An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Response

Indicates a successful call.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/osquery/packs
{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id"
  ],
  "queries": {
    "ports": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  }
}

curl Shell

curl -X POST "https://{kibana_url}/api/osquery/packs" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id"
  ],
  "queries": {
    "ports": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  }
}'

Response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": [],
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic",
    "version": 1
  }
}

Request { description , enabled , interval , min_osquery_version , name , platform , policy_ids , queries , result_type , rrule_schedule , schedule_type , shards , }

Response

Request