Get packs

GET /api/osquery/packs
Api key auth

Get a list of all query packs.

Query parameters

  • page integer | null

    The page number to return. The default is 1.

  • pageSize integer | null

    The number of results to return per page. The default is 20.

  • sort string | null

    The field that is used to sort the results.

    Default value is createdAt.

  • sortOrder string

    Specifies the sort order.

    Values are asc or desc.

Responses

  • 200 application/json

    OK
GET /api/osquery/packs 
curl \ --request GET 'https://<KIBANA_URL>/api/osquery/packs' \ --header "Authorization: $API_KEY"
Response examples (200) 
{ "data": [ { "id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d", "type": "osquery-pack", "attributes": { "name": "My Pack", "enabled": true, "queries": [ { "id": "uptime", "query": "select * from uptime;", "interval": "3600", "ecs_mapping": [ { "host.uptime": { "field": "total_seconds" } } ] } ], "created_at": "2023-10-31T00:00:00Z", "created_by": "elastic", "updated_at": "2023-10-31T00:00:00Z", "updated_by": "elastic", "description": "My pack description" }, "namespaces": [ "default" ] } ], "page": 1, "total": 1, "pageSize": 10, "policy_ids": [] }