Create a pack
- Base URL
-
https://{kibana_url}
- POST /api/osquery/packs
- POST /s/{space_id}/api/osquery/packs
Create a query pack.
Path parameters
-
space_idstringoptional -
An identifier for the space. If
space_idis not provided in the URL, the default space is used. Refer to Spaces for more information.
Request body
-
intervalinteger · min: 1 -
Pack-level interval, in seconds. Used when
schedule_typeisinterval. Mutually exclusive withrrule_schedule. -
min_osquery_versionstring · min length: 1 · max length: 64 · pattern: ^\d+(\.\d+){0,2}$ -
Minimum osquery version required to run this pack or query. Formatted as a numeric version string, e.g.
"5.10.0". Non-numeric values (e.g."latest") are rejected. -
platformstring · min length: 1 · max length: 256 -
Pack-level platform restriction. To specify multiple platforms, use commas. For example,
linux,darwin. -
queriesmap string to object -
An object of queries.
-
<string>object -
ecs_mappingmap string to object -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
enabledboolean -
Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
-
intervalintegernullable -
Interval for this query, in seconds. Overrides the pack's
intervalwhen this query also hasschedule_type: interval. If you sendintervalwithoutschedule_type: interval, Kibana removes it when saving, and the query uses the pack'sintervalinstead. Ignored when the pack'sschedule_typeisrrule. -
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
result_typeenum -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
rrule_scheduleobject -
RRULE schedule configuration consumed by osquerybeat. Loose date forms like
"2024-01-01"are rejected with 400. DTSTART is NOT embedded inrrule; the separatestart_datefield is the schedule anchor. -
end_datestring · format: date-time · max length: 64 -
Optional RFC 3339 datetime string for the schedule's end. MUST be after
start_date. -
rrulestring · max length: 2048required -
Fully serialized RFC 5545 RRULE string (e.g.
"FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts —FREQ,INTERVAL,BYDAY,BYMONTHDAY,BYMONTH— but the server accepts and round-trips any well-formed parts (other recognized parts likeBYHOUR,BYMINUTE,BYSETPOS,WKST,COUNT,UNTILare preserved verbatim). -
splaystring · max length: 64 -
Optional Go duration string for splay (random execution delay), e.g.
"30s","5m","1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). -
schedule_typeenum -
Discriminator for the pack's schedule mode.
intervaluses native osqueryd interval scheduling (seconds).rruleuses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. -
Values:
intervalrrule -
versionstring · max length: 64 · pattern: ^(\d+(\.\d+){0,2})?$ -
Uses the Osquery versions greater than or equal to the specified version string. Formatted as a numeric version string, e.g.
"5.10.0", or an empty string to inherit the pack'smin_osquery_version(no constraint if the pack has none). Non-numeric values (e.g."latest") are rejected. -
result_typeenum -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
rrule_scheduleobject -
RRULE schedule configuration consumed by osquerybeat. Loose date forms like
"2024-01-01"are rejected with 400. DTSTART is NOT embedded inrrule; the separatestart_datefield is the schedule anchor. -
end_datestring · format: date-time · max length: 64 -
Optional RFC 3339 datetime string for the schedule's end. MUST be after
start_date. -
rrulestring · max length: 2048required -
Fully serialized RFC 5545 RRULE string (e.g.
"FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts —FREQ,INTERVAL,BYDAY,BYMONTHDAY,BYMONTH— but the server accepts and round-trips any well-formed parts (other recognized parts likeBYHOUR,BYMINUTE,BYSETPOS,WKST,COUNT,UNTILare preserved verbatim). -
splaystring · max length: 64 -
Optional Go duration string for splay (random execution delay), e.g.
"30s","5m","1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). -
schedule_typeenum -
Discriminator for the pack's schedule mode.
intervaluses native osqueryd interval scheduling (seconds).rruleuses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. -
Values:
intervalrrule
Response
Indicates a successful call.
-
dataobjectrequired -
intervalinteger · min: 1 -
Pack-level interval, in seconds. Used when
schedule_typeisinterval. Mutually exclusive withrrule_schedule. -
min_osquery_versionstring · min length: 1 · max length: 64 -
Minimum osquery version required to run this pack or query, e.g.
"5.10.0". -
platformstring · min length: 1 · max length: 256 -
Pack-level platform restriction. To specify multiple platforms, use commas. For example,
linux,darwin. -
queriesmap string to object -
An object of queries.
-
<string>object -
ecs_mappingmap string to object -
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
enabledboolean -
Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
-
intervalintegernullable -
Interval for this query, in seconds. Overrides the pack's
intervalwhen this query also hasschedule_type: interval. If you sendintervalwithoutschedule_type: interval, Kibana removes it when saving, and the query uses the pack'sintervalinstead. Ignored when the pack'sschedule_typeisrrule. -
platformstring -
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example,
linux,darwin. -
result_typeenum -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
rrule_scheduleobject -
RRULE schedule configuration consumed by osquerybeat. Loose date forms like
"2024-01-01"are rejected with 400. DTSTART is NOT embedded inrrule; the separatestart_datefield is the schedule anchor. -
end_datestring · format: date-time · max length: 64 -
Optional RFC 3339 datetime string for the schedule's end. MUST be after
start_date. -
rrulestring · max length: 2048required -
Fully serialized RFC 5545 RRULE string (e.g.
"FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts —FREQ,INTERVAL,BYDAY,BYMONTHDAY,BYMONTH— but the server accepts and round-trips any well-formed parts (other recognized parts likeBYHOUR,BYMINUTE,BYSETPOS,WKST,COUNT,UNTILare preserved verbatim). -
splaystring · max length: 64 -
Optional Go duration string for splay (random execution delay), e.g.
"30s","5m","1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). -
schedule_typeenum -
Discriminator for the pack's schedule mode.
intervaluses native osqueryd interval scheduling (seconds).rruleuses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. -
Values:
intervalrrule -
result_typeenum -
Controls the result document type emitted by osquerybeat for this pack or query.
snapshot: Full table snapshot on every scheduled run (default).differential: Rows added or removed since the previous run.differential_added_only: Only rows added since the previous run (no removals).
-
Values:
snapshotdifferentialdifferential_added_only -
rrule_scheduleobject -
RRULE schedule configuration consumed by osquerybeat. Loose date forms like
"2024-01-01"are rejected with 400. DTSTART is NOT embedded inrrule; the separatestart_datefield is the schedule anchor. -
end_datestring · format: date-time · max length: 64 -
Optional RFC 3339 datetime string for the schedule's end. MUST be after
start_date. -
rrulestring · max length: 2048required -
Fully serialized RFC 5545 RRULE string (e.g.
"FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts —FREQ,INTERVAL,BYDAY,BYMONTHDAY,BYMONTH— but the server accepts and round-trips any well-formed parts (other recognized parts likeBYHOUR,BYMINUTE,BYSETPOS,WKST,COUNT,UNTILare preserved verbatim). -
splaystring · max length: 64 -
Optional Go duration string for splay (random execution delay), e.g.
"30s","5m","1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). -
schedule_typeenum -
Discriminator for the pack's schedule mode.
intervaluses native osqueryd interval scheduling (seconds).rruleuses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. -
Values:
intervalrrule