Copy a pack

Base URL
https://{kibana_url}
Auth

Create a copy of a query pack with a unique name by appending a _copy suffix. If the name already exists, a numeric suffix is added (e.g., _copy_2). The copied pack is always created with enabled set to false.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The ID of the pack to copy.

Example: 3c42c847-eb30-4452-80e0-728584042334

Response

Indicates a successful call.

application/json
data object required
created_at string · format: date-time
created_by string nullable
created_by_profile_uid string
description string

The pack description.

enabled boolean

Enables the pack.

interval integer · min: 1

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

min_osquery_version string · min length: 1 · max length: 64

Minimum osquery version required to run this pack or query, e.g. "5.10.0".

name string required

The pack name.

platform string · min length: 1 · max length: 256

Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.

policy_ids string[]

A list of agents policy IDs.

queries object[]

Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.

ecs_mapping object[]

ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).

key string

The ECS field name.

value object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

enabled boolean

Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.

id string
interval integer
platform string
query string
removed boolean
result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
snapshot boolean
timeout integer
version string
result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.

end_date string · format: date-time · max length: 64

Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.

rrule string · max length: 2048 required

Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).

splay string · max length: 64

Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).

start_date string · format: date-time · max length: 64 required

RFC 3339 datetime string for the schedule's start.

timeout number

Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.

saved_object_id string required

The saved object ID of the copied pack.

schedule_type enum

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values: interval rrule
shards object[]

Shard configuration as an array of key-value pairs.

key string
value number
updated_at string · format: date-time
updated_by string nullable
updated_by_profile_uid string
version integer

The pack version number.

Base URL
https://{kibana_url}