--- type: api title: Update a pack description: **Spaces method and path for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryupdatepacks resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryupdatepacks products: - Kibana --- # Update a pack - Server: `https://{kibana_url}` ## Paths - `PUT` `/api/osquery/packs/{id}` - `PUT` `/s/{space_id}/api/osquery/packs/{id}` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth) #### Path Parameters - `id` (string) The pack ID. ## Description Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Update a query pack using the pack ID. > info > You cannot update a prebuilt pack. ## Request Body `application/json` - `description` (string) — optional The pack description. - `enabled` (boolean) — optional Enables the pack. - `interval` (integer · min: 1) — optional Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`. - `min_osquery_version` (string · min: 1 · max: 64 · pattern: ^\d+(\.\d+){0,2}$) — optional Minimum osquery version required to run this pack or query. Formatted as a numeric version string, e.g. `"5.10.0"`. Non-numeric values (e.g. `"latest"`) are rejected. - `name` (string) — optional The pack name. - `platform` (string · min: 1 · max: 256) — optional Pack-level platform restriction. To specify multiple platforms, use commas. For example, `linux,darwin`. - `policy_ids` ([] object) — optional A list of agents policy IDs. - `queries` (object) — optional An object of queries. - `result_type` (enum) — optional Controls the result document type emitted by osquerybeat for this pack or query. - `snapshot`: Full table snapshot on every scheduled run (default). - `differential`: Rows added or removed since the previous run. - `differential_added_only`: Only rows added since the previous run (no removals). Values: `snapshot`, `differential`, `differential_added_only` - `rrule_schedule` ({}) — optional RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor. - `end_date` (string · max: 64) — optional Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`. - `rrule` (string · max: 2048) — required Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim). - `splay` (string · max: 64) — optional Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). - `start_date` (string · max: 64) — required RFC 3339 datetime string for the schedule's start. - `timeout` (number) — optional Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset. - `schedule_type` (enum) — optional Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. Values: `interval`, `rrule` - `shards` (object) — optional An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts. ## Response Indicates a successful call. `application/json` - `data` (object) - `created_at` (string) - `created_by` (string) — nullable - `created_by_profile_uid` (string) - `description` (string) The pack description. - `enabled` (boolean) Enables the pack. - `interval` (integer · min: 1) Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`. - `min_osquery_version` (string · min: 1 · max: 64) Minimum osquery version required to run this pack or query, e.g. `"5.10.0"`. - `name` (string) The pack name. - `platform` (string · min: 1 · max: 256) Pack-level platform restriction. To specify multiple platforms, use commas. For example, `linux,darwin`. - `policy_ids` ([] object) A list of agents policy IDs. - `queries` (object) An object of queries. - `result_type` (enum) Controls the result document type emitted by osquerybeat for this pack or query. - `snapshot`: Full table snapshot on every scheduled run (default). - `differential`: Rows added or removed since the previous run. - `differential_added_only`: Only rows added since the previous run (no removals). Values: `snapshot`, `differential`, `differential_added_only` - `rrule_schedule` ({}) RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor. - `end_date` (string · max: 64) Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`. - `rrule` (string · max: 2048) Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim). - `splay` (string · max: 64) Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). - `start_date` (string · max: 64) RFC 3339 datetime string for the schedule's start. - `timeout` (number) Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset. - `saved_object_id` (string) The saved object ID of the pack. - `schedule_type` (enum) Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. Values: `interval`, `rrule` - `shards` (object) An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts. - `updated_at` (string) - `updated_by` (string) — nullable - `updated_by_profile_uid` (string) - `version` (integer) The pack version number. ## Code Examples #### Console ```console PUT /api/osquery/packs/{id} { "description": "Updated pack description", "enabled": true, "name": "my_pack_renamed" } ``` #### curl ```curl curl -X PUT "https://{kibana_url}/api/osquery/packs/{id}" \ -H "Content-Type: application/json" \ -d '{ "description": "Updated pack description", "enabled": true, "name": "my_pack_renamed" }' ``` ## Response Examples #### Pack updated ```json { "data": { "description": "Updated pack description", "enabled": true, "name": "my_pack_renamed", "policy_ids": [ "my_policy_id" ], "queries": { "ports": { "interval": 60, "query": "SELECT * FROM listening_ports;", "removed": false, "snapshot": true, "timeout": 120 } }, "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856", "shards": [], "updated_at": "2025-02-27T10:00:00.000Z", "updated_by": "elastic", "version": 2 } } ```