Create a live query
- Base URL
-
https://{kibana_url}
-
POST
/api/osquery/live_queries
Auth
Create and run a live query.
-
agent_all
boolean
-
When true, the query runs on all agents.
-
agent_ids
string[]
-
A list of agent IDs to run the query on.
-
agent_platforms
string[]
-
A list of agent platforms to run the query on.
-
agent_policy_ids
string[]
-
A list of agent policy IDs to run the query on.
-
alert_ids
string[]
-
A list of alert IDs associated with the live query.
-
case_ids
string[]
-
A list of case IDs associated with the live query.
-
ecs_mapping
map string to object
-
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
<string>
object
-
-
field
string
-
The ECS field to map to.
-
value
union string | string[]
-
The value to map to the ECS field.
-
event_ids
string[]
-
A list of event IDs associated with the live query.
-
metadata
object
nullable
-
Custom metadata object associated with the live query.
-
pack_id
string
-
The ID of the pack.
-
queries
object[]
-
An array of queries to run.
-
-
ecs_mapping
map string to object
-
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
<string>
object
-
-
field
string
-
The ECS field to map to.
-
value
union string | string[]
-
The value to map to the ECS field.
-
enabled
boolean
-
Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
-
id
string
-
The ID of the query.
-
platform
string
-
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
-
query
string
-
The SQL query you want to run.
-
removed
boolean
-
Indicates whether the query is removed.
-
result_type
enum
-
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshot
differential
differential_added_only
-
snapshot
boolean
-
Indicates whether the query is a snapshot.
-
version
string
-
Uses the Osquery versions greater than or equal to the specified version string.
-
query
string
-
The SQL query you want to run.
-
saved_query_id
string
-
The ID of a saved query.
Indicates a successful call.
-
data
object
required
-
-
@timestamp
string · format: date-time
-
The timestamp when the action was created.
-
action_id
string
required
-
The ID of the action.
-
agent_all
boolean
-
Whether the query targets all agents.
-
agent_ids
string[]
-
The agent IDs targeted by the action.
-
agent_platforms
string[]
-
The agent platforms targeted.
-
agent_policy_ids
string[]
-
The agent policy IDs targeted.
-
agents
string[]
-
The resolved list of agent IDs.
-
expiration
string · format: date-time
-
The expiration date of the action.
-
input_type
string
-
The input type.
-
metadata
object
-
Custom metadata associated with the action.
-
pack_id
string
-
The pack ID if the query was run from a pack.
-
queries
object[]
-
The queries in this action.
-
-
ecs_mapping
map string to object
-
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
<string>
object
-
-
field
string
-
The ECS field to map to.
-
value
union string | string[]
-
The value to map to the ECS field.
-
type
string
-
The action type.
-
user_id
string
-
The user who created the action.
Thank you for your feedback.