Sign in
Security Osquery API

Get live query results

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}</span></div>

Refer to Spaces for more information.

Get the results of a live query using the query action ID.

get/api/osquery/live_queries/{id}/results/{actionId}

Path parameters

idstring required

The ID of the live query result you want to retrieve.

Example:3c42c847-eb30-4452-80e0-728584042334

The ID of the live query.

actionIdstring required

The ID of the query action that generated the live query results.

Example:609c4c66-ba3d-43fa-afdd-53e244577aa0

The ID of the query action.

Query parameters

kuerystring nullable

The kuery to filter the results by.

Example:agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13

A KQL search string to filter results.

pageinteger nullable

The page number to return. The default is 1.

Example:1

The page number to return.

pageSizeinteger nullable

The number of results to return per page. The default is 20.

Example:20

The number of results to return per page.

sortstring nullable

The field that is used to sort the results.

Example:createdAt

The field to sort results by.

sortOrder'asc' | 'desc'

Specifies the sort order.

Example:desc

The sort order.

Response

Indicates a successful call.

Example response

{
  "data": {
    "edges": [
      {
        "_id": "doc1",
        "_source": {}
      },
      {
        "_id": "doc2",
        "_source": {}
      }
    ],
    "total": 2
  }
}

Changes

No changes recorded. 20 of the 176 revisions have no diff computed, so they could not be searched.