stack kb security-osquery-api cli namespace
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Preview
Preview
Stack
Preview
Preview
elastic stack kb security-osquery-api --help
Kibana security-osquery-api API commands
osquery-get-unified-historyGet unified query history
osquery-find-live-queriesGet live queries
osquery-create-live-queryCreate a live query
osquery-get-live-query-detailsGet live query details
osquery-get-live-query-resultsGet live query results
osquery-export-live-query-resultsExport live query results
osquery-find-packsGet packs
osquery-create-packsCreate a pack
osquery-delete-packsDelete a pack
osquery-get-packs-detailsGet pack details
osquery-update-packsUpdate a pack
osquery-copy-packsCopy a pack
osquery-find-saved-queriesGet saved queries
osquery-create-saved-queryCreate a saved query
osquery-delete-saved-queryDelete a saved query
osquery-get-saved-query-detailsGet saved query details
osquery-update-saved-queryUpdate a saved query
osquery-copy-saved-queryCopy a saved query
osquery-get-scheduled-action-resultsGet scheduled action results
osquery-export-scheduled-query-resultsExport scheduled query results
osquery-get-scheduled-query-resultsGet scheduled query results