Update a pack

Base URL: https://{kibana_url}

PUT /api/osquery/packs/{id}
PUT /s/{space_id}/api/osquery/packs/{id}

Auth

Update a query pack using the pack ID.

Note

You cannot update a prebuilt pack.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id string required: Example: 3c42c847-eb30-4452-80e0-728584042334

Request body

description string: The pack description.
enabled boolean: Enables the pack.
name string: The pack name.
policy_ids string[]: A list of agents policy IDs.
queries map string to object: An object of queries.
shards map string to number: An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Response

application/json

Response Type: object

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn:/api/osquery/packs/3c42c847-eb30-4452-80e0-728584042334
{
  "name": "updated_my_pack_name"
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/osquery/packs/3c42c847-eb30-4452-80e0-728584042334" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "updated_my_pack_name"
  }'

Generated from the API spec

Response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "updated_my_pack_name",
    "queries": {
      "ports": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": [
      {
        "key": "47638692-7c4c-4053-aa3e-7186f28df349",
        "value": 35
      },
      {
        "key": "5e267651-fe50-443e-8d3f-3bbc9171b618",
        "value": 58
      }
    ],
    "updated_at": "2025-02-26T13:40:16.297Z",
    "updated_by": "elastic"
  }
}

Generated from the API spec

Path parameters

Request body { }

Response

Request body