Get saved query details
- Base URL
-
https://{kibana_url}
-
GET
/api/osquery/saved_queries/{id}
Auth
Get the details of a saved query using the query ID.
-
id
string
required
-
The saved query ID.
-
Example:
3c42c847-eb30-4452-80e0-728584042334
Indicates a successful call.
-
data
object
required
-
-
created_at
string · format: date-time
-
created_by
string
nullable
-
created_by_profile_uid
string
-
description
string
-
The saved query description.
-
ecs_mapping
map string to object
-
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
<string>
object
-
-
field
string
-
The ECS field to map to.
-
value
union string | string[]
-
The value to map to the ECS field.
-
id
string
required
-
The ID of a saved query.
-
interval
integer | string
-
platform
string
-
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
-
query
string
-
The SQL query you want to run.
-
removed
boolean
-
Indicates whether the query is removed.
-
saved_object_id
string
required
-
snapshot
boolean
-
Indicates whether the query is a snapshot.
-
updated_at
string · format: date-time
-
updated_by
string
nullable
-
updated_by_profile_uid
string
Thank you for your feedback.