Get packs APIedit
[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Get packs.
Requestedit
GET <kibana host>:<port>/api/osquery/packs
GET <kibana host>:<port>/s/<space_id>/api/osquery/packs
Path parametersedit
-
space_id -
(Optional, string) The space identifier. When
space_idis not provided in the URL, the default space is used.
Query parametersedit
-
page -
(Optional, integer) The page number to return. The default is
1. -
pageSize -
(Optional, integer) The number of rules to return per page. The default is
20. -
sort -
(Optional, string) Specifies the field that sorts the results. Options include
createdAtorupdatedAt. The default iscreatedAt.Even though the JSON case object uses the
created_atandupdated_atfields, you must usecreatedAtandupdatedAtfields in the URL query. -
sortOrder -
(Optional, string) Specifies the sort order. Options include
descorasc. The default isdesc.
Response codeedit
-
200 - Indicates a successful call.
Exampleedit
Retrieve the first 10 packs:
$ curl -X GET api/osquery/packs?page=1&perPage=10&sortField=updatedAt&sortOrder=asc
The API returns a JSON object with the retrieved packs:
{
"page": 1,
"per_page": 10,
"total": 11,
"data": [
{
"type": "osquery-pack",
"id": "bbe5b070-0c51-11ed-b0f8-ad31b008e832",
"namespaces": ["default"],
"attributes": {
"name": "test_pack",
"queries": [
{
"query": "select * from uptime",
"interval": 3600,
"id": "uptime",
"ecs_mapping": [
{
"value": {
"field": "days"
},
"key": "message"
}
]
}
],
"enabled": true,
"created_at": "2022-07-25T19:41:10.263Z",
"created_by": "elastic",
"updated_at": "2022-07-25T20:12:01.455Z",
"updated_by": "elastic",
"description": ""
},
"policy_ids": []
},
{...}
]
}
}