Get live query results

Get connector information

GET /api/actions/connector/{id}

Path parameters

id string Required

An identifier for the connector.

Responses

200 application/json

Indicates a successful call.
Hide response attributes Show response attributes object
- config object
  
  Additional properties are allowed.
- connector_type_id string Required
  
  The connector type identifier.
- id string Required
  
  The identifier for the connector.
- is_deprecated boolean Required
  
  Indicates whether the connector is deprecated.
- is_missing_secrets boolean
  
  Indicates whether the connector is missing secrets.
- is_preconfigured boolean Required
  
  Indicates whether the connector is preconfigured. If true, the config and is_missing_secrets properties are omitted from the response.
- is_system_action boolean Required
  
  Indicates whether the connector is used for system actions.
- name string Required
  
  The name of the rule.

GET /api/actions/connector/{id}

curl \
 --request GET 'https://localhost:5601/api/actions/connector/{id}' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "id": "df770e30-8b8b-11ed-a780-3b746c987a81",
  "name": "my_server_log_connector",
  "config": {},
  "is_deprecated": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "connector_type_id": ".server-log",
  "is_missing_secrets": false
}

GET /api/osquery/live_queries/{id}/results/{actionId}

Api key auth Basic auth

Get the results of a live query using the query action ID.

Path parameters

id string Required

The ID of the live query result you want to retrieve.
actionId string Required

The ID of the query action that generated the live query results.

Query parameters

kuery string | null

The kuery to filter the results by.
page integer | null

The page number to return. The default is 1.
pageSize integer | null

The number of results to return per page. The default is 20.
sort string | null

The field that is used to sort the results.

Default value is createdAt.
sortOrder string

Specifies the sort order.

Values are asc or desc.

Responses

200 application/json

OK

The response for getting live query results.

GET /api/osquery/live_queries/{id}/results/{actionId}

curl \
 --request GET 'https://localhost:5601/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "data": {
    "edges": [
      {},
      {}
    ],
    "total": 2
  }
}