Security Osquery API

Get unified query history

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/history</span></div>

Refer to Spaces for more information.

Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

get/api/osquery/history

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/osquery/history
  • Auth
    • API key in header Authorization
    • or HTTP basic

Query parameters

pageSizeinteger

The number of results to return per page.

nextPagestring

A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.

kuerystring

A search string to filter history entries by pack name, query text, or query ID.

userIdsstring

Comma-separated list of user IDs to filter live query history.

Example:elastic,admin
sourceFiltersstring

Comma-separated list of source types to include. Valid values are live, rule, and scheduled.

Example:live,scheduled
startDatestring

The start of the time range filter (ISO 8601).

Example:2024-01-01T00:00:00Z
endDatestring

The end of the time range filter (ISO 8601).

Example:2024-12-31T23:59:59Z

Response

Indicates a successful call.

hasMoreboolean required

Whether there are more results beyond the current page.

nextPagestring

A base64-encoded cursor to fetch the next page. Absent when there are no more results.

Example response

{
  "data": [
    {
      "actionId": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
      "agentCount": 5,
      "errorCount": 0,
      "id": "3c42c847-eb30-4452-80e0-728584042334",
      "queryName": "uptime_query",
      "queryText": "select * from uptime;",
      "source": "Live",
      "sourceType": "live",
      "successCount": 5,
      "timestamp": "2024-07-26T09:59:32.220Z",
      "totalRows": 42,
      "userId": "elastic"
    },
    {
      "agentCount": 10,
      "errorCount": 1,
      "executionCount": 3,
      "id": "pack_my_pack_uptime_3",
      "packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
      "packName": "My Pack",
      "plannedTime": "2024-07-26T09:00:00.000Z",
      "queryName": "uptime",
      "queryText": "select * from uptime;",
      "scheduleId": "pack_my_pack_uptime",
      "source": "Scheduled",
      "sourceType": "scheduled",
      "successCount": 9,
      "timestamp": "2024-07-26T09:00:00.000Z",
      "totalRows": 100
    }
  ],
  "hasMore": true,
  "nextPage": "eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3..."
}

Changes

No operation changes recorded.