Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Create a live query

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>

Refer to Spaces for more information.

Create and run a live query.

post/api/osquery/live_queries

Request body

agent_allboolean

When true, the query runs on all agents.

agent_idsstring[]

A list of agent IDs to run the query on.

agent_platformsstring[]

A list of agent platforms to run the query on.

agent_policy_idsstring[]

A list of agent policy IDs to run the query on.

alert_idsstring[]

A list of alert IDs associated with the live query.

case_idsstring[]

A list of case IDs associated with the live query.

ecs_mappingSecurityOsqueryAPIECSMapping

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

event_idsstring[]

A list of event IDs associated with the live query.

metadataobject nullable

Custom metadata object associated with the live query.

pack_idstring

The ID of the pack.

querystring

The SQL query you want to run.

saved_query_idstring

The ID of a saved query.

Example request

{
  "agent_all": true,
  "ecs_mapping": {
    "host.uptime": {
      "field": "total_seconds"
    }
  },
  "query": "select * from uptime;"
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "@timestamp": "2022-07-26T09:59:32.220Z",
    "action_id": "3c42c847-eb30-4452-80e0-728584042334",
    "agent_all": true,
    "agent_ids": [],
    "agent_platforms": [],
    "agent_policy_ids": [],
    "agents": [
      "16d7caf5-efd2-4212-9b62-73dafc91fa13"
    ],
    "expiration": "2022-07-26T10:04:32.220Z",
    "input_type": "osquery",
    "metadata": {
      "execution_context": {
        "name": "osquery",
        "url": "/app/osquery/live_queries/new"
      }
    },
    "queries": [
      {
        "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
        "agents": [
          "16d7caf5-efd2-4212-9b62-73dafc91fa13"
        ],
        "ecs_mapping": {
          "host.uptime": {
            "field": "total_seconds"
          }
        },
        "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
        "query": "select * from uptime;",
        "timeout": 120
      }
    ],
    "type": "INPUT_ACTION",
    "user_id": "elastic"
  }
}