Create a live query

Base URL
https://{kibana_url}
  • POST /api/osquery/live_queries
  • POST /s/{space_id}/api/osquery/live_queries
Auth

Create and run a live query.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

agent_all boolean

When true, the query runs on all agents.

agent_ids string[]

A list of agent IDs to run the query on.

agent_platforms string[]

A list of agent platforms to run the query on.

agent_policy_ids string[]

A list of agent policy IDs to run the query on.

alert_ids string[]

A list of alert IDs associated with the live query.

case_ids string[]

A list of case IDs associated with the live query.

ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

event_ids string[]

A list of event IDs associated with the live query.

metadata object nullable

Custom metadata object associated with the live query.

pack_id string

The ID of the pack.

queries object[]

An array of queries to run.

ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

enabled boolean

Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.

id string

The ID of the query.

platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

result_type enum

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
Values: snapshot differential differential_added_only
snapshot boolean

Indicates whether the query is a snapshot.

version string

Uses the Osquery versions greater than or equal to the specified version string.

query string

The SQL query you want to run.

saved_query_id string

The ID of a saved query.

Response

Indicates a successful call.

application/json
data object required
@timestamp string · format: date-time

The timestamp when the action was created.

action_id string required

The ID of the action.

agent_all boolean

Whether the query targets all agents.

agent_ids string[]

The agent IDs targeted by the action.

agent_platforms string[]

The agent platforms targeted.

agent_policy_ids string[]

The agent policy IDs targeted.

agents string[]

The resolved list of agent IDs.

expiration string · format: date-time

The expiration date of the action.

input_type string

The input type.

metadata object

Custom metadata associated with the action.

pack_id string

The pack ID if the query was run from a pack.

queries object[]

The queries in this action.

action_id string
agents string[]
ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

id string
platform string
query string
saved_query_id string
timeout integer
version string
type string

The action type.

user_id string

The user who created the action.

Base URL
https://{kibana_url}