Query parameters

• page integer | null

  The page number to return.

• pageSize integer | null

  The number of results to return per page.

• sort string | null

  The field to sort results by.

  Default value is createdAt.

• sortOrder string

  The sort order.

  Values are asc or desc.

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attributes Show response attributes object

  • data array[object] Required

    An array of pack objects.

    Hide data attributes Show data attributes object

    • created_at string(date-time)
    • created_by string | null
    • created_by_profile_uid string
    • description string

      The pack description.

    • enabled boolean

      Enables the pack.

    • name string Required

      The pack name.

    • policy_ids array[string]

      A list of agents policy IDs.

    • queries array[object]

      Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.

      Hide queries attributes Show queries attributes object

      • ecs_mapping array[object]

        ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).

        Hide ecs_mapping attributes Show ecs_mapping attributes object

        ECS mapping item in saved-object storage format (key-value pair).

        • key string

          The ECS field name.

        • value object Additional properties
          Hide value attributes Show value attributes object

          • field string

            The ECS field to map to.

          • value string | array[string]

            The value to map to the ECS field.

            One of:

            string-1 string array-2 array[string]
      • id string
      • interval integer
      • platform string
      • query string
      • removed boolean
      • snapshot boolean
      • timeout integer
      • version string
    • read_only boolean

      Whether the pack is read-only (true for prebuilt packs).

    • saved_object_id string Required

      The saved object ID of the pack.

    • updated_at string(date-time)
    • updated_by string | null
    • updated_by_profile_uid string
    • version integer

      The pack version number.

  • page integer Required

    The current page number.

  • per_page integer Required

    The number of results per page.

  • total integer Required

    The total number of packs.