Get saved queries

Base URL
https://{kibana_url}
  • GET /api/osquery/saved_queries
Auth

Get a list of all saved queries.

Query parameters

page integer nullable

The page number to return.

pageSize integer nullable

The number of results to return per page.

sort string · default: createdAt nullable

The field to sort results by.

sortOrder enum

The sort order.

Values: asc desc

Response

Indicates a successful call.

application/json
data object[] required

An array of saved query objects.

created_at string · format: date-time
created_by string nullable
created_by_profile_uid string
description string

The saved query description.

ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

id string required

The ID of a saved query.

interval integer | string
platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

prebuilt boolean
query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

saved_object_id string required
snapshot boolean

Indicates whether the query is a snapshot.

timeout integer
updated_at string · format: date-time
updated_by string nullable
updated_by_profile_uid string
version integer | string
page integer required

The current page number.

per_page integer required

The number of results per page.

total integer required

The total number of saved queries.

Base URL
https://{kibana_url}