Copy a pack

Server: https://{kibana_url}

POST /api/osquery/packs/{id}/copy
POST /s/{space_id}/api/osquery/packs/{id}/copy

Refer to Spaces for more information.

Create a copy of a query pack with a unique name by appending a _copy suffix. If the name already exists, a numeric suffix is added (e.g., _copy_2). The copied pack is always created with enabled set to false.

Path Parameters

id string required: The ID of the pack to copy.

Response

Indicates a successful call.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/osquery/packs/{id}/copy

curl Shell

curl -X POST "https://{kibana_url}/api/osquery/packs/{id}/copy"

Response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": false,
    "name": "my_pack_copy",
    "policy_ids": [],
    "queries": [
      {
        "ecs_mapping": [
          {
            "key": "client.port",
            "value": {
              "field": "port"
            }
          }
        ],
        "id": "ports",
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    ],
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": [],
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic"
  }
}