Update a saved query
Server:
https://{kibana_url}
- PUT /api/osquery/saved_queries/{id}
- PUT /s/{space_id}/api/osquery/saved_queries/{id}
Refer to Spaces for more information.
Update a saved query using the query ID.
info You cannot update a prebuilt saved query.
Path Parameters
-
idstringrequired
Request
-
descriptionstring -
The saved query description.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
idstring -
The ID of a saved query.
-
intervalstring -
An interval, in seconds, on which to run the query.
-
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
querystring -
The SQL query you want to run.
-
removedboolean -
Indicates whether the query is removed.
-
snapshotboolean -
Indicates whether the query is a snapshot.
-
versionstring -
Uses the Osquery versions greater than or equal to the specified version string.
Response
OK
Response Type: object