Security Osquery API

Get scheduled query results

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results</span></div>

Refer to Spaces for more information.

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

get/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results
  • Auth
    • API key in header Authorization
    • or HTTP basic

Path parameters

scheduleIdstring required

The schedule ID of the scheduled query.

Example:pack_my_pack_uptime
executionCountinteger required

The execution count for this scheduled query run.

Example:3

Query parameters

kuerystring nullable

The kuery to filter the results by.

Example:agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
pageinteger nullable

The page number to return. The default is 1.

Example:1
pageSizeinteger nullable

The number of results to return per page. The default is 20.

Example:20
sortstring nullable

The field that is used to sort the results.

Example:createdAt
sortOrder'asc' | 'desc'

Specifies the sort order.

Example:desc
startDatestring

The start date filter (ISO 8601) to narrow down results.

Example:2024-01-01T00:00:00Z

Response

Indicates a successful call.

Example response

{
  "data": {
    "edges": [
      {
        "_id": "row-001",
        "fields": {
          "host.uptime": [
            "12345"
          ]
        }
      },
      {
        "_id": "row-002",
        "fields": {
          "host.uptime": [
            "67890"
          ]
        }
      }
    ],
    "total": 2
  }
}

Changes

No operation changes recorded.