Get unified query history
https://{kibana_url}
- GET /api/osquery/history
Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.
Query Parameters
-
pageSizeinteger · min: 1 · max: 100 · default: 20 The number of results to return per page.
-
nextPagestring A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
-
kuerystring A search string to filter history entries by pack name, query text, or query ID.
-
userIdsstring Comma-separated list of user IDs to filter live query history.
-
sourceFiltersstring Comma-separated list of source types to include. Valid values are
live,rule, andscheduled.-
startDatestring The start of the time range filter (ISO 8601).
-
endDatestring The end of the time range filter (ISO 8601).
Response
Indicates a successful call.
-
data -
The list of unified history rows for the current page.
-
agentCountintegerrequired -
For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded.
-
errorCountintegernullable -
The number of agent responses with errors.
-
idstringrequired -
Unique identifier for the history row.
-
packIdstring -
The ID of the pack containing the query.
-
packNamestring -
The name of the pack containing the query.
-
queryNamestring -
The name of the query, if available.
-
queryTextstringrequired -
The SQL query that was executed.
-
spaceIdstring -
The Kibana space ID where the query was executed.
-
successCountintegernullable -
The number of successful agent responses.
-
timestampstringrequired -
The timestamp of the query execution.
-
totalRowsintegernullable -
The total number of result rows returned across all agents.
-
actionIdstring -
The Fleet action ID for the live query.
-
agentAllboolean -
Whether the query targeted all agents.
-
agentIdsstring -
List of targeted agent IDs.
-
agentPlatformsstring -
List of targeted agent platforms.
-
agentPolicyIdsstring -
List of targeted agent policy IDs.
-
ecsMappingobject -
ECS mapping configuration used for the query.
-
queriesTotalinteger -
The total number of sub-queries in the live action.
-
queriesWithResultsinteger -
The number of sub-queries that returned results.
-
savedQueryIdstring -
The saved query ID, if the live query was based on a saved query.
-
source -
Whether this was a manually run live query or triggered by a rule.
-
Values:
LiveRule -
timeoutinteger -
The query timeout in seconds.
-
userIdstring -
The ID of the user who ran the query.
-
userProfileUidstring -
The user profile UID of the user who ran the query.
-
agentCountintegerrequired -
For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded.
-
errorCountintegernullable -
The number of agent responses with errors.
-
idstringrequired -
Unique identifier for the history row.
-
packIdstring -
The ID of the pack containing the query.
-
packNamestring -
The name of the pack containing the query.
-
queryNamestring -
The name of the query, if available.
-
queryTextstringrequired -
The SQL query that was executed.
-
spaceIdstring -
The Kibana space ID where the query was executed.
-
successCountintegernullable -
The number of successful agent responses.
-
timestampstringrequired -
The timestamp of the query execution.
-
totalRowsintegernullable -
The total number of result rows returned across all agents.
-
executionCountinteger -
The execution count for this scheduled query run.
-
plannedTimestring -
The planned execution time for the scheduled query.
-
scheduleIdstring -
The schedule ID for the scheduled query.
-
hasMorebooleanrequired -
Whether there are more results beyond the current page.
-
nextPagestring -
A base64-encoded cursor to fetch the next page. Absent when there are no more results.