Create a pack

Base URL: https://{kibana_url}

POST /api/osquery/packs
POST /s/{space_id}/api/osquery/packs

Refer to Spaces for more information.

Create a query pack.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/osquery/packs
{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id",
    "fleet-server-policy"
  ],
  "queries": {
    "my_query": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        },
        "tags": {
          "value": [
            "tag1",
            "tag2"
          ]
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  },
  "shards": {
    "fleet-server-policy": 58,
    "my_policy_id": 35
  }
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/osquery/packs" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id",
      "fleet-server-policy"
    ],
    "queries": {
      "my_query": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          },
          "tags": {
            "value": [
              "tag1",
              "tag2"
            ]
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "timeout": 120
      }
    },
    "shards": {
      "fleet-server-policy": 58,
      "my_policy_id": 35
    }
  }'

Generated from the API spec

Response

No example

Authentication

Request body { }

Response

Request body