Kibana Security Osquery API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Security Osquery API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.
This API exposes
19 operations
across 12 paths,
and defines 57 schemas.
It is described by OpenAPI 3.0.3.
Requests are made against a single base URL, https://{kibana_url}.
The identity and technical contract details declared by the specification.
Security_Osquery_API_FindSavedQueryResponse
object
A paginated list of saved queries.
4 properties
4 required
Security_Osquery_API_CreatePacksResponse
object
The response for creating a pack.
1 property
1 required
Security_Osquery_API_Query
string
The SQL query you want to run.
Security_Osquery_API_Platform
string
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
Security_Osquery_API_SortOrderOrUndefined
string
Specifies the sort order.
Security_Osquery_API_UpdateSavedQueryRequestBody
object
9 properties
Security_Osquery_API_CopySavedQueryResponse
object
The response for copying a saved query.
1 property
1 required
Security_Osquery_API_PolicyIds
array
A list of agents policy IDs.
Security_Osquery_API_ECSMappingItem
object
2 properties
Security_Osquery_API_ObjectQueries
object
An object of queries.
Security_Osquery_API_ECSMappingArray
array
ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object fo…
Security_Osquery_API_PackId
string
The ID of the pack.
Security_Osquery_API_UpdateSavedQueryResponse
object
The response for updating a saved query.
1 property
1 required
Security_Osquery_API_LiveHistoryRow
Security_Osquery_API_FindLiveQueryResponse
object
1 property
Security_Osquery_API_KueryOrUndefined
string
The kuery to filter the results by.
Security_Osquery_API_UnifiedHistoryRowBase
object
11 properties
4 required
Security_Osquery_API_DefaultSuccessResponse
object
Security_Osquery_API_UnifiedHistoryRow
Security_Osquery_API_ScheduledActionResultsAggregations
object
5 properties
Security_Osquery_API_Interval
string
An interval, in seconds, on which to run the query.
Security_Osquery_API_FindPacksResponse
object
A paginated list of query packs.
4 properties
4 required
Security_Osquery_API_FindLiveQueryDetailsResponse
object
1 property
Security_Osquery_API_UpdatePacksRequestBody
object
6 properties
Security_Osquery_API_FindPackResponse
object
The details of a single query pack.
1 property
1 required
Security_Osquery_API_Version
string
Uses the Osquery versions greater than or equal to the specified version string.
Security_Osquery_API_CopyPacksResponse
object
The response for copying a pack.
1 property
1 required
Security_Osquery_API_PageOrUndefined
integer
The page number to return. The default is 1.
Security_Osquery_API_CreatePacksRequestBody
object
6 properties
Security_Osquery_API_ScheduledHistoryRow
Security_Osquery_API_CreateSavedQueryRequestBody
object
9 properties
Security_Osquery_API_ArrayQueriesItem
object
7 properties
Security_Osquery_API_FindSavedQueryDetailResponse
object
The details of a single saved query.
1 property
1 required
Security_Osquery_API_CreateLiveQueryRequestBody
object
13 properties
Security_Osquery_API_CreateSavedQueryResponse
object
The response for creating a saved query.
1 property
1 required
Security_Osquery_API_PackDescription
string
The pack description.
Security_Osquery_API_SavedQueryDescription
string
The saved query description.
Security_Osquery_API_ArrayQueries
array
An array of queries to run.
Security_Osquery_API_ObjectQueriesItem
object
8 properties
Security_Osquery_API_ScheduledExecutionMetadata
object
Execution metadata resolved from the pack saved object.
7 properties
Security_Osquery_API_Shards
object
An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
Security_Osquery_API_CreateLiveQueryResponse
object
The response for creating a live query.
1 property
1 required
Security_Osquery_API_ECSMapping
object
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
Security_Osquery_API_ECSMappingArrayItem
object
ECS mapping item in saved-object storage format (key-value pair).
2 properties
Security_Osquery_API_GetUnifiedHistoryResponse
object
3 properties
2 required
Security_Osquery_API_Enabled
boolean
Enables the pack.
Security_Osquery_API_SortOrUndefined
string
The field that is used to sort the results.
Security_Osquery_API_GetScheduledQueryResultsResponse
object
The response for getting scheduled query results.
1 property
Security_Osquery_API_GetScheduledActionResultsResponse
object
8 properties
Security_Osquery_API_PageSizeOrUndefined
integer
The number of results to return per page. The default is 20.
Security_Osquery_API_Snapshot
boolean
Indicates whether the query is a snapshot.
Security_Osquery_API_UpdatePacksResponse
object
The response for updating a pack.
1 property
Security_Osquery_API_SavedQueryId
string
The ID of a saved query.
Security_Osquery_API_QueryId
string
The ID of the query.
Security_Osquery_API_GetLiveQueryResultsResponse
object
The response for getting live query results.
1 property
Security_Osquery_API_PackName
string
The pack name.
Security_Osquery_API_Removed
boolean
Indicates whether the query is removed.
The full machine-readable OpenAPI contract behind this narrative.
Other APIs Kibana publishes across the network.
