Create a pack

POST /api/osquery/packs

Api key auth

Spaces method and path for this operation:

post /s/{space_id}/api/osquery/packs

Refer to Spaces for more information.

Create a query pack.

application/json

Body Required

description string

The pack description.
enabled boolean

Enables the pack.
interval integer

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

Minimum value is 1.
min_osquery_version string

Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. "5.10.0".

Minimum length is 1, maximum length is 64.
name string

The pack name.
platform string

Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.

Minimum length is 1, maximum length is 256.
policy_ids array[string]

A list of agents policy IDs.
queries object

An object of queries.
Hide queries attribute Show queries attribute object
- * object Additional properties
  Hide * attributes Show * attributes object
  
  ecs_mapping object
  
  Map osquery results columns or static values to Elastic Common Schema (ECS) fields
  
  Hide ecs_mapping attribute Show ecs_mapping attribute object
  
  * object Additional properties
  
  Hide * attributes Show * attributes object
  
  field string
  
  The ECS field to map to.
  
  value string | array[string]
  
  The value to map to the ECS field.
  
  One of:
  string-1 string array-2 array[string]
  
  enabled boolean
  
  Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
  
  id string
  
  The ID of the query.
  
  interval integer | null
  
  Interval for this query, in seconds. Overrides the pack's interval when this query also has schedule_type: interval. If you send interval without schedule_type: interval, Kibana removes it when saving, and the query uses the pack's interval instead. Ignored when the pack's schedule_type is rrule.
  
  platform string
  
  Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
  
  query string
  
  The SQL query you want to run.
  
  removed boolean
  
  Indicates whether the query is removed.
  
  result_type string
  
  Controls the result document type emitted by osquerybeat for this pack or query.
  
  snapshot: Full table snapshot on every scheduled run (default).
  
  differential: Rows added or removed since the previous run.
  
  differential_added_only: Only rows added since the previous run (no removals).
  
  Values are snapshot, differential, or differential_added_only.
  
  rrule_schedule object
  
  RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.
  
  Hide rrule_schedule attributes Show rrule_schedule attributes object
  
  end_date string(date-time)
  
  Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.
  
  Maximum length is 64.
  
  rrule string Required
  
  Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).
  
  Maximum length is 2048.
  
  splay string
  
  Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
  
  Maximum length is 64.
  
  start_date string(date-time) Required
  
  RFC 3339 datetime string for the schedule's start.
  
  Maximum length is 64.
  
  timeout number
  
  Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
  
  saved_query_id string
  
  The ID of a saved query.
  
  schedule_type string
  
  Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
  
  Values are interval or rrule.
  
  snapshot boolean
  
  Indicates whether the query is a snapshot.
  
  version string
  
  Uses the Osquery versions greater than or equal to the specified version string.
result_type string
Controls the result document type emitted by osquerybeat for this pack or query.
- snapshot: Full table snapshot on every scheduled run (default).
- differential: Rows added or removed since the previous run.
- differential_added_only: Only rows added since the previous run (no removals).
Values are snapshot, differential, or differential_added_only.
rrule_schedule object

RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.
Hide rrule_schedule attributes Show rrule_schedule attributes object
- end_date string(date-time)
  
  Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.
  
  Maximum length is 64.
- rrule string Required
  
  Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).
  
  Maximum length is 2048.
- splay string
  
  Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
  
  Maximum length is 64.
- start_date string(date-time) Required
  
  RFC 3339 datetime string for the schedule's start.
  
  Maximum length is 64.
- timeout number
  
  Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
schedule_type string

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

Values are interval or rrule.
shards object

An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
Hide shards attribute Show shards attribute object
- * number Additional properties

Responses

200 application/json

Indicates a successful call.
Hide response attribute Show response attribute object
- data object Required
  
  Hide data attributes Show data attributes object
  
  created_at string(date-time)
  
  The date and time the pack was created.
  
  created_by string | null
  
  The user who created the pack.
  
  created_by_profile_uid string
  
  The profile UID of the user who created the pack.
  
  description string
  
  The pack description.
  
  enabled boolean
  
  Enables the pack.
  
  interval integer
  
  Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.
  
  Minimum value is 1.
  
  min_osquery_version string
  
  Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. "5.10.0".
  
  Minimum length is 1, maximum length is 64.
  
  name string Required
  
  The pack name.
  
  platform string
  
  Pack-level platform restriction. To specify multiple platforms, use commas. For example, linux,darwin.
  
  Minimum length is 1, maximum length is 256.
  
  policy_ids array[string]
  
  A list of agents policy IDs.
  
  queries object
  
  An object of queries.
  
  Hide queries attribute Show queries attribute object
  
  * object Additional properties
  
  Hide * attributes Show * attributes object
  
  ecs_mapping object
  
  Map osquery results columns or static values to Elastic Common Schema (ECS) fields
  
  Hide ecs_mapping attribute Show ecs_mapping attribute object
  
  * object Additional properties
  
  Hide * attributes Show * attributes object
  
  field string
  
  The ECS field to map to.
  
  value string | array[string]
  
  The value to map to the ECS field.
  
  One of:
  string-1 string array-2 array[string]
  
  enabled boolean
  
  Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.
  
  id string
  
  The ID of the query.
  
  interval integer | null
  
  Interval for this query, in seconds. Overrides the pack's interval when this query also has schedule_type: interval. If you send interval without schedule_type: interval, Kibana removes it when saving, and the query uses the pack's interval instead. Ignored when the pack's schedule_type is rrule.
  
  platform string
  
  Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
  
  query string
  
  The SQL query you want to run.
  
  removed boolean
  
  Indicates whether the query is removed.
  
  result_type string
  
  Controls the result document type emitted by osquerybeat for this pack or query.
  
  snapshot: Full table snapshot on every scheduled run (default).
  
  differential: Rows added or removed since the previous run.
  
  differential_added_only: Only rows added since the previous run (no removals).
  
  Values are snapshot, differential, or differential_added_only.
  
  rrule_schedule object
  
  RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.
  
  Hide rrule_schedule attributes Show rrule_schedule attributes object
  
  end_date string(date-time)
  
  Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.
  
  Maximum length is 64.
  
  rrule string Required
  
  Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).
  
  Maximum length is 2048.
  
  splay string
  
  Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
  
  Maximum length is 64.
  
  start_date string(date-time) Required
  
  RFC 3339 datetime string for the schedule's start.
  
  Maximum length is 64.
  
  timeout number
  
  Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
  
  saved_query_id string
  
  The ID of a saved query.
  
  schedule_type string
  
  Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
  
  Values are interval or rrule.
  
  snapshot boolean
  
  Indicates whether the query is a snapshot.
  
  version string
  
  Uses the Osquery versions greater than or equal to the specified version string.
  
  result_type string
  
  Controls the result document type emitted by osquerybeat for this pack or query.
  
  snapshot: Full table snapshot on every scheduled run (default).
  
  differential: Rows added or removed since the previous run.
  
  differential_added_only: Only rows added since the previous run (no removals).
  
  Values are snapshot, differential, or differential_added_only.
  
  rrule_schedule object
  
  RRULE schedule configuration consumed by osquerybeat. Loose date forms like "2024-01-01" are rejected with 400. DTSTART is NOT embedded in rrule; the separate start_date field is the schedule anchor.
  
  Hide rrule_schedule attributes Show rrule_schedule attributes object
  
  end_date string(date-time)
  
  Optional RFC 3339 datetime string for the schedule's end. MUST be after start_date.
  
  Maximum length is 64.
  
  rrule string Required
  
  Fully serialized RFC 5545 RRULE string (e.g. "FREQ=WEEKLY;BYDAY=MO,WE,FR"). The Kibana UI writes only a subset of parts — FREQ, INTERVAL, BYDAY, BYMONTHDAY, BYMONTH — but the server accepts and round-trips any well-formed parts (other recognized parts like BYHOUR, BYMINUTE, BYSETPOS, WKST, COUNT, UNTIL are preserved verbatim).
  
  Maximum length is 2048.
  
  splay string
  
  Optional Go duration string for splay (random execution delay), e.g. "30s", "5m", "1h". The Kibana form writes single-unit values only; compound durations ("1h30m") are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
  
  Maximum length is 64.
  
  start_date string(date-time) Required
  
  RFC 3339 datetime string for the schedule's start.
  
  Maximum length is 64.
  
  timeout number
  
  Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
  
  saved_object_id string Required
  
  The saved object ID of the pack.
  
  schedule_type string
  
  Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
  
  Values are interval or rrule.
  
  shards array[object]
  
  Shard configuration as an array of key-value pairs.
  
  Hide shards attributes Show shards attributes object
  
  key string
  
  value number
  
  updated_at string(date-time)
  
  The date and time the pack was last updated.
  
  updated_by string | null
  
  The user who last updated the pack.
  
  updated_by_profile_uid string
  
  The profile UID of the user who last updated the pack.
  
  version integer
  
  The pack version number.

POST /api/osquery/packs

curl \
 --request POST 'https://<KIBANA_URL>/api/osquery/packs' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id"
  ],
  "queries": {
    "ports": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  }
}'

Request example

{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id"
  ],
  "queries": {
    "ports": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  }
}

Response examples (200)

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": [],
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic",
    "version": 1
  }
}

Create a pack

Body Required

value string | array[string]

Responses

value string | array[string]