Security Osquery API
Get live query results
Spaces method and path for this operation:
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}</span></div>Refer to Spaces for more information.
Get the results of a live query using the query action ID.
get/api/osquery/live_queries/{id}/results/{actionId}
Path parameters
idstring required
The ID of the live query result you want to retrieve.
Example:3c42c847-eb30-4452-80e0-728584042334
The ID of the live query.
actionIdstring required
The ID of the query action that generated the live query results.
Example:609c4c66-ba3d-43fa-afdd-53e244577aa0
The ID of the query action.
Query parameters
kuerystring nullable
The kuery to filter the results by.
Example:agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
A KQL search string to filter results.
pageinteger nullable
The page number to return. The default is 1.
Example:1
The page number to return.
pageSizeinteger nullable
The number of results to return per page. The default is 20.
Example:20
The number of results to return per page.
sortstring nullable
The field that is used to sort the results.
Example:createdAt
The field to sort results by.
sortOrder'asc' | 'desc'
Specifies the sort order.
Example:desc
The sort order.
Response
Indicates a successful call.
Example response
{
"data": {
"edges": [
{
"_id": "doc1",
"_source": {}
},
{
"_id": "doc2",
"_source": {}
}
],
"total": 2
}
}