IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Get packs API
editGet packs API
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Get packs.
Request
editGET <kibana host>:<port>/api/osquery/packs
GET <kibana host>:<port>/s/<space_id>/api/osquery/packs
Path parameters
edit-
space_id
-
(Optional, string) The space identifier. When
space_id
is not provided in the URL, the default space is used.
Query parameters
edit-
page
-
(Optional, integer) The page number to return. The default is
1
. -
pageSize
-
(Optional, integer) The number of rules to return per page. The default is
20
. -
sort
-
(Optional, string) Specifies the field that sorts the results. Options include
createdAt
orupdatedAt
. The default iscreatedAt
.Even though the JSON case object uses the
created_at
andupdated_at
fields, you must usecreatedAt
andupdatedAt
fields in the URL query. -
sortOrder
-
(Optional, string) Specifies the sort order. Options include
desc
orasc
. The default isdesc
.
Response code
edit-
200
- Indicates a successful call.
Example
editRetrieve the first 10 packs:
$ curl -X GET api/osquery/packs?page=1&perPage=10&sortField=updatedAt&sortOrder=asc
The API returns a JSON object with the retrieved packs:
{ "page": 1, "per_page": 10, "total": 11, "data": [ { "type": "osquery-pack", "id": "bbe5b070-0c51-11ed-b0f8-ad31b008e832", "namespaces": ["default"], "attributes": { "name": "test_pack", "queries": [ { "query": "select * from uptime", "interval": 3600, "id": "uptime", "ecs_mapping": [ { "value": { "field": "days" }, "key": "message" } ] } ], "enabled": true, "created_at": "2022-07-25T19:41:10.263Z", "created_by": "elastic", "updated_at": "2022-07-25T20:12:01.455Z", "updated_by": "elastic", "description": "" }, "policy_ids": [] }, {...} ] } }