Security Osquery API

Get scheduled action results

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}</span></div>

Refer to Spaces for more information.

Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

get/api/osquery/scheduled_results/{scheduleId}/{executionCount}

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/osquery/scheduled_results/{scheduleId}/{executionCount}
  • Auth
    • API key in header Authorization
    • or HTTP basic

Path parameters

scheduleIdstring required

The schedule ID of the scheduled query.

Example:pack_my_pack_uptime
executionCountinteger required

The execution count for this scheduled query run.

Example:3

Query parameters

kuerystring nullable

The kuery to filter the results by.

Example:agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
pageinteger nullable

The page number to return. The default is 1.

Example:1
pageSizeinteger nullable

The number of results to return per page. The default is 20.

Example:20
sortstring nullable

The field that is used to sort the results.

Example:createdAt
sortOrder'asc' | 'desc'

Specifies the sort order.

Example:desc

Response

Indicates a successful call.

currentPageinteger

The current page number (zero-based).

edgesobject[]

The paginated list of per-agent action results.

inspectobject

Debug/inspection data for the search query.

pageSizeinteger

The number of results per page.

totalinteger

The total number of action results.

totalPagesinteger

The total number of pages.

Example response

{
  "aggregations": {
    "failed": 1,
    "pending": 0,
    "successful": 9,
    "totalResponded": 10,
    "totalRowCount": 42
  },
  "currentPage": 0,
  "edges": [
    {
      "_id": "result-001",
      "fields": {
        "agent_id": "16d7caf5-efd2-4212-9b62-73dafc91fa13",
        "rows_count": 5,
        "status": "success"
      }
    }
  ],
  "metadata": {
    "executionCount": 3,
    "packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
    "packName": "My Pack",
    "queryName": "uptime",
    "queryText": "select * from uptime;",
    "scheduleId": "pack_my_pack_uptime",
    "timestamp": "2024-07-26T09:00:00.000Z"
  },
  "pageSize": 20,
  "total": 10,
  "totalPages": 1
}

Changes

No operation changes recorded.