Create a pack

Base URL
https://{kibana_url}
  • POST /api/osquery/packs
Auth

Create a query pack.

Request body

description string

The pack description.

enabled boolean

Enables the pack.

interval integer · min: 1

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

min_osquery_version string · min length: 1 · max length: 64

Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. "5.10.0".

name string

The pack name.

platform string · min length: 1 · max length: 256

Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.

policy_ids string[]

A list of agents policy IDs.

queries map string to object

An object of queries.

<string> object
ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

enabled boolean

Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.

id string

The ID of the query.

interval integer nullable

Interval for this query, in seconds. Overrides the pack's interval when this query also has schedule_type: interval. If you send interval without schedule_type: interval, Kibana removes it when saving, and the query uses the pack's interval instead. Ignored when the pack's schedule_type is rrule.

platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

saved_query_id string

The ID of a saved query.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
snapshot boolean

Indicates whether the query is a snapshot.

version string

Uses the Osquery versions greater than or equal to the specified version string.

result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
shards map string to number

An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Response

Indicates a successful call.

application/json
data object required
created_at string · format: date-time

The date and time the pack was created.

created_by string nullable

The user who created the pack.

created_by_profile_uid string

The profile UID of the user who created the pack.

description string

The pack description.

enabled boolean

Enables the pack.

interval integer · min: 1

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

min_osquery_version string · min length: 1 · max length: 64

Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. "5.10.0".

name string required

The pack name.

platform string · min length: 1 · max length: 256

Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.

policy_ids string[]

A list of agents policy IDs.

queries map string to object

An object of queries.

<string> object
ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

enabled boolean

Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.

id string

The ID of the query.

interval integer nullable

Interval for this query, in seconds. Overrides the pack's interval when this query also has schedule_type: interval. If you send interval without schedule_type: interval, Kibana removes it when saving, and the query uses the pack's interval instead. Ignored when the pack's schedule_type is rrule.

platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

saved_query_id string

The ID of a saved query.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
snapshot boolean

Indicates whether the query is a snapshot.

version string

Uses the Osquery versions greater than or equal to the specified version string.

result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

saved_object_id string required

The saved object ID of the pack.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
shards object[]

Shard configuration as an array of key-value pairs.

key string
value number
updated_at string · format: date-time

The date and time the pack was last updated.

updated_by string nullable

The user who last updated the pack.

updated_by_profile_uid string

The profile UID of the user who last updated the pack.

version integer

The pack version number.

Base URL
https://{kibana_url}