Get packs
https://{kibana_url}
- GET /api/osquery/packs
Get a list of all query packs.
Response
Indicates a successful call.
-
dataobjectrequired -
An array of pack objects.
-
created_atstring -
created_bystringnullable -
created_by_profile_uidstring -
descriptionstring -
The pack description.
-
enabledboolean -
Enables the pack.
-
intervalinteger · min: 1 -
Pack-level interval, in seconds. Used when
schedule_typeisinterval. Mutually exclusive withrrule_schedule. -
min_osquery_versionstring · min: 1 · max: 64 -
Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g.
"5.10.0". -
namestringrequired -
The pack name.
-
platformstring · min: 1 · max: 256 -
Pack-level platform restriction. To specify multiple platforms, use commas. For example,
linux,darwin. -
policy_idsobject -
A list of agents policy IDs.
-
queriesobject -
Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.
-
ecs_mappingobject -
ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).
-
enabledboolean -
Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
-
idstring -
intervalinteger -
platformstring -
querystring -
removedboolean -
result_type -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
rrule_schedule -
RRULE schedule configuration consumed by osquerybeat. Loose date forms like
"2024-01-01"are rejected with 400. DTSTART is NOT embedded inrrule; the separatestart_datefield is the schedule anchor. -
end_datestring · max: 64 -
Optional RFC 3339 datetime string for the schedule's end. MUST be after
start_date. -
rrulestring · max: 2048required -
Fully serialized RFC 5545 RRULE string (e.g.
"FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts —FREQ,INTERVAL,BYDAY,BYMONTHDAY,BYMONTH— but the server accepts and round-trips any well-formed parts (other recognized parts likeBYHOUR,BYMINUTE,BYSETPOS,WKST,COUNT,UNTILare preserved verbatim). -
splaystring · max: 64 -
Optional Go duration string for splay (random execution delay), e.g.
"30s","5m","1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). -
start_datestring · max: 64required -
RFC 3339 datetime string for the schedule's start.
-
timeoutnumber -
Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
-
schedule_type -
Discriminator for the pack's schedule mode.
intervaluses native osqueryd interval scheduling (seconds).rruleuses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. -
Values:
intervalrrule -
snapshotboolean -
timeoutinteger -
versionstring -
read_onlyboolean -
Whether the pack is read-only (true for prebuilt packs).
-
result_type -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
rrule_schedule -
RRULE schedule configuration consumed by osquerybeat. Loose date forms like
"2024-01-01"are rejected with 400. DTSTART is NOT embedded inrrule; the separatestart_datefield is the schedule anchor. -
end_datestring · max: 64 -
Optional RFC 3339 datetime string for the schedule's end. MUST be after
start_date. -
rrulestring · max: 2048required -
Fully serialized RFC 5545 RRULE string (e.g.
"FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts —FREQ,INTERVAL,BYDAY,BYMONTHDAY,BYMONTH— but the server accepts and round-trips any well-formed parts (other recognized parts likeBYHOUR,BYMINUTE,BYSETPOS,WKST,COUNT,UNTILare preserved verbatim). -
splaystring · max: 64 -
Optional Go duration string for splay (random execution delay), e.g.
"30s","5m","1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). -
start_datestring · max: 64required -
RFC 3339 datetime string for the schedule's start.
-
timeoutnumber -
Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
-
saved_object_idstringrequired -
The saved object ID of the pack.
-
schedule_type -
Discriminator for the pack's schedule mode.
intervaluses native osqueryd interval scheduling (seconds).rruleuses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. -
Values:
intervalrrule -
updated_atstring -
updated_bystringnullable -
updated_by_profile_uidstring -
versioninteger -
The pack version number.
-
pageintegerrequired -
The current page number.
-
per_pageintegerrequired -
The number of results per page.
-
totalintegerrequired -
The total number of packs.