Get packs

Base URL: https://{kibana_url}

GET /api/osquery/packs
GET /s/{space_id}/api/osquery/packs

Auth

Get a list of all query packs.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer nullable
pageSize integer nullable
sort string · default: createdAt nullable
sortOrder enum: Values: asc desc

Response

application/json

Response Type: object

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/packs

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/packs" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": [
    {
      "attributes": {
        "created_at": "2023-10-31T00:00:00Z",
        "created_by": "elastic",
        "description": "My pack description",
        "enabled": true,
        "name": "My Pack",
        "queries": [
          {
            "ecs_mapping": [
              {
                "host.uptime": {
                  "field": "total_seconds"
                }
              }
            ],
            "id": "uptime",
            "interval": "3600",
            "query": "select * from uptime;"
          }
        ],
        "updated_at": "2023-10-31T00:00:00Z",
        "updated_by": "elastic"
      },
      "id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
      "namespaces": [
        "default"
      ],
      "type": "osquery-pack"
    }
  ],
  "page": 1,
  "pageSize": 10,
  "policy_ids": [],
  "total": 1
}

Generated from the API spec