Get unified query history

Base URL: https://{kibana_url}

GET /api/osquery/history
GET /s/{space_id}/api/osquery/history

Refer to Spaces for more information.

Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Response

Indicates a successful call.

application/json

data union oneOf[] required: The list of unified history rows for the current page.; One of:
hasMore boolean required: Whether there are more results beyond the current page.
nextPage string: A base64-encoded cursor to fetch the next page. Absent when there are no more results.

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/history

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/history" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": [
    {
      "actionId": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
      "agentCount": 5,
      "errorCount": 0,
      "id": "3c42c847-eb30-4452-80e0-728584042334",
      "queryName": "uptime_query",
      "queryText": "select * from uptime;",
      "source": "Live",
      "sourceType": "live",
      "successCount": 5,
      "timestamp": "2024-07-26T09:59:32.220Z",
      "totalRows": 42,
      "userId": "elastic"
    },
    {
      "agentCount": 10,
      "errorCount": 1,
      "executionCount": 3,
      "id": "pack_my_pack_uptime_3",
      "packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
      "packName": "My Pack",
      "plannedTime": "2024-07-26T09:00:00.000Z",
      "queryName": "uptime",
      "queryText": "select * from uptime;",
      "scheduleId": "pack_my_pack_uptime",
      "source": "Scheduled",
      "sourceType": "scheduled",
      "successCount": 9,
      "timestamp": "2024-07-26T09:00:00.000Z",
      "totalRows": 100
    }
  ],
  "hasMore": true,
  "nextPage": "eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3..."
}