{
"opencollection": "1.0.0",
"info": {
"name": "Kibana APIs Actions Security Osquery API API",
"version": "1.0"
},
"request": {
"auth": {
"type": "apikey",
"key": "Authorization",
"value": "{{Authorization}}",
"placement": "header"
}
},
"items": [
{
"info": {
"name": "Security Osquery API",
"type": "folder"
},
"items": [
{
"info": {
"name": "Get unified query history",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/history",
"params": [
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page."
},
{
"name": "nextPage",
"value": "",
"type": "query",
"description": "A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page."
},
{
"name": "kuery",
"value": "",
"type": "query",
"description": "A search string to filter history entries by pack name, query text, or query ID."
},
{
"name": "userIds",
"value": "",
"type": "query",
"description": "Comma-separated list of user IDs to filter live query history."
},
{
"name": "sourceFilters",
"value": "",
"type": "query",
"description": "Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`."
},
{
"name": "startDate",
"value": "",
"type": "query",
"description": "The start of the time range filter (ISO 8601)."
},
{
"name": "endDate",
"value": "",
"type": "query",
"description": "The end of the time range filter (ISO 8601)."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/history
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.\n"
},
{
"info": {
"name": "Get live queries",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/live_queries",
"params": [
{
"name": "kuery",
"value": "",
"type": "query",
"description": "A KQL search string to filter live queries."
},
{
"name": "page",
"value": "",
"type": "query",
"description": "The page number to return."
},
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page."
},
{
"name": "sort",
"value": "",
"type": "query",
"description": "The field to sort results by."
},
{
"name": "sortOrder",
"value": "",
"type": "query",
"description": "The sort order."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all live queries."
},
{
"info": {
"name": "Create a live query",
"type": "http"
},
"http": {
"method": "POST",
"url": "https://{kibana_url}/api/osquery/live_queries",
"body": {
"type": "json",
"data": "{}"
}
},
"docs": "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/live_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and run a live query."
},
{
"info": {
"name": "Get live query details",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/live_queries/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The ID of the live query."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/live_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a live query using the query ID."
},
{
"info": {
"name": "Get live query results",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/live_queries/:id/results/:actionId",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The ID of the live query."
},
{
"name": "actionId",
"value": "",
"type": "path",
"description": "The ID of the query action."
},
{
"name": "kuery",
"value": "",
"type": "query",
"description": "A KQL search string to filter results."
},
{
"name": "page",
"value": "",
"type": "query",
"description": "The page number to return."
},
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page."
},
{
"name": "sort",
"value": "",
"type": "query",
"description": "The field to sort results by."
},
{
"name": "sortOrder",
"value": "",
"type": "query",
"description": "The sort order."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the results of a live query using the query action ID."
},
{
"info": {
"name": "Get packs",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/packs",
"params": [
{
"name": "page",
"value": "",
"type": "query",
"description": "The page number to return."
},
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page."
},
{
"name": "sort",
"value": "",
"type": "query",
"description": "The field to sort results by."
},
{
"name": "sortOrder",
"value": "",
"type": "query",
"description": "The sort order."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all query packs."
},
{
"info": {
"name": "Create a pack",
"type": "http"
},
"http": {
"method": "POST",
"url": "https://{kibana_url}/api/osquery/packs",
"body": {
"type": "json",
"data": "{}"
}
},
"docs": "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/packs
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a query pack."
},
{
"info": {
"name": "Get pack details",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/packs/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The pack ID."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a query pack using the pack ID."
},
{
"info": {
"name": "Update a pack",
"type": "http"
},
"http": {
"method": "PUT",
"url": "https://{kibana_url}/api/osquery/packs/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The pack ID."
}
],
"body": {
"type": "json",
"data": "{}"
}
},
"docs": "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a query pack using the pack ID.\n> info\n> You cannot update a prebuilt pack.\n"
},
{
"info": {
"name": "Delete a pack",
"type": "http"
},
"http": {
"method": "DELETE",
"url": "https://{kibana_url}/api/osquery/packs/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The pack ID."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/osquery/packs/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a query pack using the pack ID."
},
{
"info": {
"name": "Copy a pack",
"type": "http"
},
"http": {
"method": "POST",
"url": "https://{kibana_url}/api/osquery/packs/:id/copy",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The ID of the pack to copy."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/packs/{id}/copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `fal"
},
{
"info": {
"name": "Get saved queries",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/saved_queries",
"params": [
{
"name": "page",
"value": "",
"type": "query",
"description": "The page number to return."
},
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page."
},
{
"name": "sort",
"value": "",
"type": "query",
"description": "The field to sort results by."
},
{
"name": "sortOrder",
"value": "",
"type": "query",
"description": "The sort order."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/saved_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all saved queries."
},
{
"info": {
"name": "Create a saved query",
"type": "http"
},
"http": {
"method": "POST",
"url": "https://{kibana_url}/api/osquery/saved_queries",
"body": {
"type": "json",
"data": "{}"
}
},
"docs": "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/saved_queries
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate and save a query for later use."
},
{
"info": {
"name": "Get saved query details",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/saved_queries/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The saved query ID."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a saved query using the query ID."
},
{
"info": {
"name": "Update a saved query",
"type": "http"
},
"http": {
"method": "PUT",
"url": "https://{kibana_url}/api/osquery/saved_queries/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The saved query ID."
}
],
"body": {
"type": "json",
"data": "{}"
}
},
"docs": "**Spaces method and path for this operation:**\n\nput /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpdate a saved query using the query ID.\n> info\n> You cannot update a prebuilt saved query.\n"
},
{
"info": {
"name": "Delete a saved query",
"type": "http"
},
"http": {
"method": "DELETE",
"url": "https://{kibana_url}/api/osquery/saved_queries/:id",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The saved query ID."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\ndelete /s/{space_id}/api/osquery/saved_queries/{id}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDelete a saved query using the query ID."
},
{
"info": {
"name": "Copy a saved query",
"type": "http"
},
"http": {
"method": "POST",
"url": "https://{kibana_url}/api/osquery/saved_queries/:id/copy",
"params": [
{
"name": "id",
"value": "",
"type": "path",
"description": "The ID of the saved query to copy."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\npost /s/{space_id}/api/osquery/saved_queries/{id}/copy
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate a copy of a saved query with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`)."
},
{
"info": {
"name": "Get scheduled action results",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/scheduled_results/:scheduleId/:executionCount",
"params": [
{
"name": "scheduleId",
"value": "",
"type": "path",
"description": "The schedule ID of the scheduled query."
},
{
"name": "executionCount",
"value": "",
"type": "path",
"description": "The execution count for this scheduled query run."
},
{
"name": "kuery",
"value": "",
"type": "query",
"description": "The kuery to filter the results by."
},
{
"name": "page",
"value": "",
"type": "query",
"description": "The page number to return. The default is 1."
},
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page. The default is 20."
},
{
"name": "sort",
"value": "",
"type": "query",
"description": "The field that is used to sort the results."
},
{
"name": "sortOrder",
"value": "",
"type": "query",
"description": "Specifies the sort order."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).\n"
},
{
"info": {
"name": "Get scheduled query results",
"type": "http"
},
"http": {
"method": "GET",
"url": "https://{kibana_url}/api/osquery/scheduled_results/:scheduleId/:executionCount/results",
"params": [
{
"name": "scheduleId",
"value": "",
"type": "path",
"description": "The schedule ID of the scheduled query."
},
{
"name": "executionCount",
"value": "",
"type": "path",
"description": "The execution count for this scheduled query run."
},
{
"name": "kuery",
"value": "",
"type": "query",
"description": "The kuery to filter the results by."
},
{
"name": "page",
"value": "",
"type": "query",
"description": "The page number to return. The default is 1."
},
{
"name": "pageSize",
"value": "",
"type": "query",
"description": "The number of results to return per page. The default is 20."
},
{
"name": "sort",
"value": "",
"type": "query",
"description": "The field that is used to sort the results."
},
{
"name": "sortOrder",
"value": "",
"type": "query",
"description": "Specifies the sort order."
},
{
"name": "startDate",
"value": "",
"type": "query",
"description": "The start date filter (ISO 8601) to narrow down results."
}
]
},
"docs": "**Spaces method and path for this operation:**\n\nget /s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results
\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet paginated query result rows (the actual osquery output data) for a specific scheduled query execution.\n"
}
]
}
],
"bundled": true
}