Get saved queries
Server:
https://{kibana_url}
- GET /api/osquery/saved_queries
- GET /s/{space_id}/api/osquery/saved_queries
Refer to Spaces for more information.
Get a list of all saved queries.
Response
Indicates a successful call.
-
dataobjectrequired -
An array of saved query objects.
-
created_atstring -
created_bystringnullable -
created_by_profile_uidstring -
descriptionstring -
The saved query description.
-
ecs_mappingobject -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
idstringrequired -
The ID of a saved query.
-
intervalinteger | string -
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
prebuiltboolean -
querystring -
The SQL query you want to run.
-
removedboolean -
Indicates whether the query is removed.
-
saved_object_idstringrequired -
snapshotboolean -
Indicates whether the query is a snapshot.
-
timeoutinteger -
updated_atstring -
updated_bystringnullable -
updated_by_profile_uidstring -
versioninteger | string -
pageintegerrequired -
The current page number.
-
per_pageintegerrequired -
The number of results per page.
-
totalintegerrequired -
The total number of saved queries.