Get packs

Base URL
https://{kibana_url}
  • GET /api/osquery/packs
Auth

Get a list of all query packs.

Query parameters

page integer nullable

The page number to return.

pageSize integer nullable

The number of results to return per page.

sort string · default: createdAt nullable

The field to sort results by.

sortOrder enum

The sort order.

Values: asc desc

Response

Indicates a successful call.

application/json
data object[] required

An array of pack objects.

created_at string · format: date-time
created_by string nullable
created_by_profile_uid string
description string

The pack description.

enabled boolean

Enables the pack.

interval integer · min: 1

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

min_osquery_version string · min length: 1 · max length: 64

Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. "5.10.0".

name string required

The pack name.

platform string · min length: 1 · max length: 256

Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.

policy_ids string[]

A list of agents policy IDs.

queries object[]

Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.

ecs_mapping object[]

ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).

key string

The ECS field name.

value object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

enabled boolean

Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.

id string
interval integer
platform string
query string
removed boolean
result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
snapshot boolean
timeout integer
version string
read_only boolean

Whether the pack is read-only (true for prebuilt packs).

result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

saved_object_id string required

The saved object ID of the pack.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
updated_at string · format: date-time
updated_by string nullable
updated_by_profile_uid string
version integer

The pack version number.

page integer required

The current page number.

per_page integer required

The number of results per page.

total integer required

The total number of packs.

Base URL
https://{kibana_url}