Security Osquery
Run live queries, manage packs and saved queries.
-
Get unified query history
Stack
9.4+
- GET /api/osquery/history
-
Get live queries
- GET /api/osquery/live_queries
-
Create a live query
- POST /api/osquery/live_queries
-
Get live query details
- GET /api/osquery/live_queries/{id}
-
Get live query results
- GET /api/osquery/live_queries/{id}/results/{actionId}
-
Export live query results
Stack
9.5+
- POST /api/osquery/live_queries/{id}/results/{actionId}/_export
-
Get packs
- GET /api/osquery/packs
-
Create a pack
- POST /api/osquery/packs
-
Get pack details
- GET /api/osquery/packs/{id}
-
Update a pack
- PUT /api/osquery/packs/{id}
-
Delete a pack
- DELETE /api/osquery/packs/{id}
-
Copy a pack
Stack
9.4+
- POST /api/osquery/packs/{id}/copy
-
Get saved queries
- GET /api/osquery/saved_queries
-
Create a saved query
- POST /api/osquery/saved_queries
-
Get saved query details
- GET /api/osquery/saved_queries/{id}
-
Update a saved query
- PUT /api/osquery/saved_queries/{id}
-
Delete a saved query
- DELETE /api/osquery/saved_queries/{id}
-
Copy a saved query
Stack
9.4+
- POST /api/osquery/saved_queries/{id}/copy
-
Get scheduled action results
Stack
9.4+
- GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}
-
Export scheduled query results
Stack
9.5+
- POST /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export
-
Get scheduled query results
Stack
9.4+
- GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results