ELelastic
Security Osquery API

Get packs

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>

Refer to Spaces for more information.

Get a list of all query packs.

get/api/osquery/packs

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/osquery/packs
  • Auth
    • API key in header Authorization
    • or HTTP basic

Query parameters

pageinteger nullable

The page number to return. The default is 1.

Example:1

The page number to return.

pageSizeinteger nullable

The number of results to return per page. The default is 20.

Example:20

The number of results to return per page.

sortstring nullable

The field that is used to sort the results.

Example:createdAt

The field to sort results by.

sortOrder'asc' | 'desc'

Specifies the sort order.

Example:desc

The sort order.

Response

Indicates a successful call.

pageinteger required

The current page number.

per_pageinteger required

The number of results per page.

totalinteger required

The total number of packs.

Example response

{
  "data": [
    {
      "created_at": "2023-10-31T00:00:00Z",
      "created_by": "elastic",
      "created_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
      "description": "My pack description",
      "enabled": true,
      "name": "My Pack",
      "policy_ids": [],
      "queries": [
        {
          "ecs_mapping": [
            {
              "key": "host.uptime",
              "value": {
                "field": "total_seconds"
              }
            }
          ],
          "id": "uptime",
          "interval": 3600,
          "query": "select * from uptime;"
        }
      ],
      "read_only": false,
      "saved_object_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
      "updated_at": "2023-10-31T00:00:00Z",
      "updated_by": "elastic",
      "updated_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
    }
  ],
  "page": 1,
  "per_page": 10,
  "total": 1
}

Changes

  • d19ae49ca6b0Revision changes
    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property // to the response with the status

  • e943f4ca339aRevision changes
    • info

      added the optional property // to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status