Create a live query
https://{kibana_url}
- POST /api/osquery/live_queries
Create and run a live query.
Request
-
agent_allboolean -
When
true, the query runs on all agents. -
agent_idsstring -
A list of agent IDs to run the query on.
-
agent_platformsstring -
A list of agent platforms to run the query on.
-
agent_policy_idsstring -
A list of agent policy IDs to run the query on.
-
alert_idsstring -
A list of alert IDs associated with the live query.
-
case_idsstring -
A list of case IDs associated with the live query.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
event_idsstring -
A list of event IDs associated with the live query.
-
metadataobjectnullable -
Custom metadata object associated with the live query.
-
pack_idstring -
The ID of the pack.
-
queriesobject -
An array of queries to run.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
enabledboolean -
Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
-
idstring -
The ID of the query.
-
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
querystring -
The SQL query you want to run.
-
removedboolean -
Indicates whether the query is removed.
-
result_type -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
snapshotboolean -
Indicates whether the query is a snapshot.
-
versionstring -
Uses the Osquery versions greater than or equal to the specified version string.
-
querystring -
The SQL query you want to run.
-
saved_query_idstring -
The ID of a saved query.
Response
Indicates a successful call.
-
dataobjectrequired -
@timestampstring -
The timestamp when the action was created.
-
action_idstringrequired -
The ID of the action.
-
agent_allboolean -
Whether the query targets all agents.
-
agent_idsstring -
The agent IDs targeted by the action.
-
agent_platformsstring -
The agent platforms targeted.
-
agent_policy_idsstring -
The agent policy IDs targeted.
-
agentsstring -
The resolved list of agent IDs.
-
expirationstring -
The expiration date of the action.
-
input_typestring -
The input type.
-
metadataobject -
Custom metadata associated with the action.
-
pack_idstring -
The pack ID if the query was run from a pack.
-
queriesobject -
The queries in this action.
-
action_idstring -
agentsstring -
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
idstring -
platformstring -
querystring -
saved_query_idstring -
timeoutinteger -
versionstring -
typestring -
The action type.
-
user_idstring -
The user who created the action.