--- type: api title: Create a pack description: Create a query pack. url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-osquerycreatepacks resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-osquerycreatepacks products: - Kibana --- # Create a pack - Server: `https://{kibana_url}` ## Paths - `POST` `/api/osquery/packs` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth) ## Description Create a query pack. ## Request Body `application/json` - `description` (string) — optional The pack description. - `enabled` (boolean) — optional Enables the pack. - `interval` (integer · min: 1) — optional Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`. - `min_osquery_version` (string · min: 1 · max: 64) — optional Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. `"5.10.0"`. - `name` (string) — optional The pack name. - `platform` (string · min: 1 · max: 256) — optional Pack-level platform restriction. To specify multiple platforms, use commas. For example, `linux,darwin`. - `policy_ids` ([] object) — optional A list of agents policy IDs. - `queries` (object) — optional An object of queries. - `result_type` (enum) — optional Controls the result document type emitted by osquerybeat for this pack or query. - `snapshot`: Full table snapshot on every scheduled run (default). - `differential`: Rows added or removed since the previous run. - `differential_added_only`: Only rows added since the previous run (no removals). Values: `snapshot`, `differential`, `differential_added_only` - `rrule_schedule` ({}) — optional RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor. - `end_date` (string · max: 64) — optional Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`. - `rrule` (string · max: 2048) — required Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim). - `splay` (string · max: 64) — optional Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). - `start_date` (string · max: 64) — required RFC 3339 datetime string for the schedule's start. - `timeout` (number) — optional Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset. - `schedule_type` (enum) — optional Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. Values: `interval`, `rrule` - `shards` (object) — optional An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts. ## Response Indicates a successful call. `application/json` - `data` (object) - `created_at` (string) The date and time the pack was created. - `created_by` (string) — nullable The user who created the pack. - `created_by_profile_uid` (string) The profile UID of the user who created the pack. - `description` (string) The pack description. - `enabled` (boolean) Enables the pack. - `interval` (integer · min: 1) Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`. - `min_osquery_version` (string · min: 1 · max: 64) Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. `"5.10.0"`. - `name` (string) The pack name. - `platform` (string · min: 1 · max: 256) Pack-level platform restriction. To specify multiple platforms, use commas. For example, `linux,darwin`. - `policy_ids` ([] object) A list of agents policy IDs. - `queries` (object) An object of queries. - `result_type` (enum) Controls the result document type emitted by osquerybeat for this pack or query. - `snapshot`: Full table snapshot on every scheduled run (default). - `differential`: Rows added or removed since the previous run. - `differential_added_only`: Only rows added since the previous run (no removals). Values: `snapshot`, `differential`, `differential_added_only` - `rrule_schedule` ({}) RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor. - `end_date` (string · max: 64) Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`. - `rrule` (string · max: 2048) Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim). - `splay` (string · max: 64) Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). - `start_date` (string · max: 64) RFC 3339 datetime string for the schedule's start. - `timeout` (number) Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset. - `saved_object_id` (string) The saved object ID of the pack. - `schedule_type` (enum) Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. Values: `interval`, `rrule` - `shards` ([] object) Shard configuration as an array of key-value pairs. - `key` (string) - `value` (number) - `updated_at` (string) The date and time the pack was last updated. - `updated_by` (string) — nullable The user who last updated the pack. - `updated_by_profile_uid` (string) The profile UID of the user who last updated the pack. - `version` (integer) The pack version number. ## Code Examples #### Console ```console POST /api/osquery/packs { "description": "My pack", "enabled": true, "name": "my_pack", "policy_ids": [ "my_policy_id" ], "queries": { "ports": { "ecs_mapping": { "client.port": { "field": "port" } }, "interval": 60, "query": "SELECT * FROM listening_ports;", "timeout": 120 } } } ``` #### curl ```curl curl -X POST "https://{kibana_url}/api/osquery/packs" \ -H "Content-Type: application/json" \ -d '{ "description": "My pack", "enabled": true, "name": "my_pack", "policy_ids": [ "my_policy_id" ], "queries": { "ports": { "ecs_mapping": { "client.port": { "field": "port" } }, "interval": 60, "query": "SELECT * FROM listening_ports;", "timeout": 120 } } }' ``` ## Response Examples #### Pack created ```json { "data": { "created_at": "2025-02-26T13:37:30.452Z", "created_by": "elastic", "description": "My pack", "enabled": true, "name": "my_pack", "policy_ids": [ "my_policy_id" ], "queries": { "ports": { "interval": 60, "query": "SELECT * FROM listening_ports;", "removed": false, "snapshot": true, "timeout": 120 } }, "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856", "shards": [], "updated_at": "2025-02-26T13:37:30.452Z", "updated_by": "elastic", "version": 1 } } ```