Get agent policies
- Base URL
-
https://{kibana_url}
- GET /api/fleet/agent_policies
- GET /s/{space_id}/api/fleet/agent_policies
List all agent policies.
Required authorization
- Privileges fleet-agent-policies-read or fleet-agents-read or fleet-setup
Path parameters
-
space_idstringoptional -
An identifier for the space. If
space_idis not provided in the URL, the default space is used. Refer to Spaces for more information.
Responses
Successful response
-
itemsobject[] · max items: 10000required -
global_data_tagsobject[] · max items: 100 -
User defined data tags that are added to all of the inputs. The values can be strings or numbers.
-
is_protectedbooleanrequired -
Indicates whether the agent policy has tamper protection enabled. Defaults to
false. -
keep_monitoring_alivebooleannullable -
When set to true, monitoring will be enabled but logs/metrics collection will be disabled
-
overridesmap string to objectnullable -
Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
-
package_policiesunion anyOf - Any of:
-
additional_datastreams_permissionsstring[] · max items: 1000nullable -
Additional data stream permissions that will be added to the agent policy.
-
cloud_connector_namestring · min length: 1 · max length: 255nullable -
Transient field for cloud connector name during creation.
-
conditionstring · max length: 10000nullable -
Agent condition expression to evaluate whether to apply this integration to its inputs.
-
inputsunion anyOfrequired -
Package policy inputs.
- Any of:
-
<string>object -
conditionstring · max length: 10000nullable -
Agent condition expression to evaluate whether to apply this input.
-
streamsmap string to object -
Input streams. Refer to the integration documentation to know which streams are available.
-
namespacestring · max length: 100 -
The package policy namespace. Leave blank to inherit the agent policy's namespace.
-
overridesobjectnullable -
Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
-
policy_idstringnullable deprecated -
ID of the agent policy which the package policy will be added to.
-
supports_agentlessbooleannullable -
Indicates whether the package policy belongs to an agentless agent policy.
-
supports_cloud_connectorbooleannullable -
Indicates whether the package policy supports cloud connectors.
-
var_group_selectionsmap string to string -
Variable group selections. Maps var_group name to the selected option name within that group.
-
<string>string · max length: 1024
string[]
package_policy_response[]
{ compiled_input, enabled, streams, … }[]
Package policy inputs. Refer to the integration documentation to know which inputs are available.