Create a live query
https://{kibana_url}
- POST /api/osquery/live_queries
- POST /s/{space_id}/api/osquery/live_queries
Refer to Spaces for more information.
Create and run a live query.
Request
-
agent_allboolean -
When
true, the query runs on all agents. -
agent_idsstring -
A list of agent IDs to run the query on.
-
agent_platformsstring -
A list of agent platforms to run the query on.
-
agent_policy_idsstring -
A list of agent policy IDs to run the query on.
-
alert_idsstring -
A list of alert IDs associated with the live query.
-
case_idsstring -
A list of case IDs associated with the live query.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
event_idsstring -
A list of event IDs associated with the live query.
-
metadataobjectnullable -
Custom metadata object associated with the live query.
-
pack_idstring -
The ID of the pack you want to run, retrieve, update, or delete.
-
queriesobject -
An array of queries to run.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
idstring -
The ID of the query.
-
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
querystring -
The SQL query you want to run.
-
removedboolean -
Indicates whether the query is removed.
-
snapshotboolean -
Indicates whether the query is a snapshot.
-
versionstring -
Uses the Osquery versions greater than or equal to the specified version string.
-
querystring -
The SQL query you want to run.
-
saved_query_idstring -
The ID of a saved query.
Response
OK
Response Type: object