Create a pack

Base URL
https://{kibana_url}
  • POST /api/osquery/packs
  • POST /s/{space_id}/api/osquery/packs
Auth

Create a query pack.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

description string

The pack description.

enabled boolean

Enables the pack.

name string

The pack name.

policy_ids string[]

A list of agents policy IDs.

queries map string to object

An object of queries.

<string> object
ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

id string

The ID of the query.

platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

saved_query_id string

The ID of a saved query.

snapshot boolean

Indicates whether the query is a snapshot.

version string

Uses the Osquery versions greater than or equal to the specified version string.

shards map string to number

An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Response

OK

application/json

Response Type: object

Base URL
https://{kibana_url}