Create a saved query
https://{kibana_url}
- POST /api/osquery/saved_queries
- POST /s/{space_id}/api/osquery/saved_queries
Refer to Spaces for more information.
Create and save a query for later use.
Request
-
descriptionstring -
The saved query description.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
idstring -
The ID of a saved query.
-
intervalstring -
An interval, in seconds, on which to run the query.
-
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
querystring -
The SQL query you want to run.
-
removedboolean -
Indicates whether the query is removed.
-
snapshotboolean -
Indicates whether the query is a snapshot.
-
versionstring -
Uses the Osquery versions greater than or equal to the specified version string.
Response
Indicates a successful call.
-
dataobjectrequired -
created_atstring -
created_bystringnullable -
created_by_profile_uidstring -
descriptionstring -
The saved query description.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
idstringrequired -
The ID of a saved query.
-
intervalinteger | string -
An interval, in seconds, on which to run the query. May be returned as number or string.
-
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
prebuiltboolean -
Whether the saved query is prebuilt.
-
querystring -
The SQL query you want to run.
-
removedboolean -
Indicates whether the query is removed.
-
saved_object_idstringrequired -
The saved object ID of the saved query.
-
snapshotboolean -
Indicates whether the query is a snapshot.
-
timeoutinteger -
The query timeout in seconds.
-
updated_atstring -
updated_bystringnullable -
updated_by_profile_uidstring -
versioninteger | string -
The saved query version.