Get live queries

Base URL
https://{kibana_url}
  • GET /api/osquery/live_queries
  • GET /s/{space_id}/api/osquery/live_queries
Auth

Get a list of all live queries.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

kuery string nullable

A KQL search string to filter live queries.

Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable

The page number to return.

pageSize integer nullable

The number of results to return per page.

sort string · default: createdAt nullable

The field to sort results by.

sortOrder enum

The sort order.

Values: asc desc

Response

Indicates a successful call.

application/json
data object
items object[]

An array of live query action items.

_source object
@timestamp string · format: date-time
action_id string
agents string[]
expiration string · format: date-time
pack_id string
queries object[]
action_id string
agents string[]
ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

id string
query string
saved_query_id string
result_counts object

Result count statistics (present when withResultCounts is true).

error_agents integer
responded_agents integer
successful_agents integer
total_rows integer
user_id string
total integer

The total number of live queries.

Base URL
https://{kibana_url}