Sign in
Security Osquery API

Update a pack

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>

Refer to Spaces for more information.

Update a query pack using the pack ID.

info You cannot update a prebuilt pack.

put/api/osquery/packs/{id}

Path parameters

idstring required

The ID of the pack.

Example:3c42c847-eb30-4452-80e0-728584042334

The pack ID.

Request body

descriptionstring

The pack description.

enabledboolean

Enables the pack.

intervalinteger

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

min_osquery_versionstring

Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. "5.10.0".

namestring

The pack name.

platformstring

Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.

policy_idsstring[]

A list of agents policy IDs.

queriesSecurityOsqueryAPIObjectQueries

An object of queries.

result_type'snapshot' | 'differential' | 'differential_added_only'

Controls the result document type emitted by osquerybeat for this pack or query.

  • snapshot: Full table snapshot on every scheduled run (default).
  • differential: Rows added or removed since the previous run.
  • differential_added_only: Only rows added since the previous run (no removals).
schedule_type'interval' | 'rrule'

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

shardsSecurityOsqueryAPIShards

An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Example request

{
  "name": "updated_my_pack_name"
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "updated_my_pack_name",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": {
      "47638692-7c4c-4053-aa3e-7186f28df349": 35,
      "5e267651-fe50-443e-8d3f-3bbc9171b618": 58
    },
    "updated_at": "2025-02-26T13:40:16.297Z",
    "updated_by": "elastic",
    "version": 1
  }
}

Changes

Changed in 2 of the 176 revisions of this API.12

  • d19ae49ca6b010See the full diff
    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      added the new optional request property //

      new-optional-request-property

    • ○

      added the new optional request property //

      new-optional-request-property

    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property /// to the response with the status

      response-optional-property-added

    • ○

      added the optional property /// to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

  • a44a4c3b7e972See the full diff
    • ○

      added the new optional request property //

      new-optional-request-property

    • ○

      added the optional property /// to the response with the status

      response-optional-property-added

Of the 176 revisions, 20 have no diff computed.