GET /api/osquery/saved_queries/{id}
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/osquery/saved_queries/{id}

Refer to Spaces for more information.

Get the details of a saved query using the query ID.

Path parameters

  • id string Required

    The saved query ID.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attribute Show response attribute object
    • data object Required
      Hide data attributes Show data attributes object
      • created_at string(date-time)
      • created_by string | null
      • created_by_profile_uid string
      • description string

        The saved query description.

      • ecs_mapping object

        Map osquery results columns or static values to Elastic Common Schema (ECS) fields

        Hide ecs_mapping attribute Show ecs_mapping attribute object
        • * object Additional properties
          Hide * attributes Show * attributes object
      • id string Required

        The ID of a saved query.

      • interval integer | string

        One of:
        integer-1 integer string-2 string
      • platform string

        Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

      • prebuilt boolean
      • query string

        The SQL query you want to run.

      • removed boolean

        Indicates whether the query is removed.

      • saved_object_id string Required
      • snapshot boolean

        Indicates whether the query is a snapshot.

      • timeout integer
      • updated_at string(date-time)
      • updated_by string | null
      • updated_by_profile_uid string

      • version integer | string

        One of:
        integer-1 integer string-2 string
GET /api/osquery/saved_queries/{id} 
curl \
 --request GET 'https://<KIBANA_URL>/api/osquery/saved_queries/3c42c847-eb30-4452-80e0-728584042334' \
 --header "Authorization: $API_KEY"