Security Osquery API
Copy a pack
Spaces method and path for this operation:
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/osquery/packs/{id}/copy</span></div>Refer to Spaces for more information.
Create a copy of a query pack with a unique name by appending a _copy suffix. If the name already exists, a numeric suffix is added (e.g., _copy_2). The copied pack is always created with enabled set to false.
post/api/osquery/packs/{id}/copy
Path parameters
idstring required
The ID of the pack.
Example:3c42c847-eb30-4452-80e0-728584042334
The ID of the pack to copy.
Response
Indicates a successful call.
Example response
{
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "My pack",
"enabled": false,
"name": "my_pack_copy",
"policy_ids": [],
"queries": [
{
"ecs_mapping": [
{
"key": "client.port",
"value": {
"field": "port"
}
}
],
"id": "ports",
"interval": 60,
"query": "SELECT * FROM listening_ports;",
"removed": false,
"snapshot": true,
"timeout": 120
}
],
"saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
"shards": [],
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic"
}
}