Body Required

• agent_all boolean
• agent_ids array[string]
• agent_platforms array[string]
• agent_policy_ids array[string]
• alert_ids array[string]
• case_ids array[string]
• ecs_mapping object | null
  Hide ecs_mapping attribute Show ecs_mapping attribute object | null

  • * object Additional properties

    Additional properties are allowed.

    Hide * attributes Show * attributes object

    • field string

    • value string | array[string]

      One of:

      string-1 string array-2 array[string]
• event_ids array[string]
• metadata object | null

  Additional properties are allowed.

• pack_id string | null
• queries array[object]
  Hide queries attributes Show queries attributes object

  • ecs_mapping object | null
    Hide ecs_mapping attribute Show ecs_mapping attribute object | null

    • * object Additional properties

      Additional properties are allowed.

      Hide * attributes Show * attributes object

      • field string

      • value string | array[string]

        One of:

        string-1 string array-2 array[string]
  • id string
  • platform string | null
  • query string
  • removed boolean | null
  • snapshot boolean | null
  • version string | null
• query string
• saved_query_id string | null