Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Update a pack

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>

Refer to Spaces for more information.

Update a query pack using the pack ID.

info You cannot update a prebuilt pack.

put/api/osquery/packs/{id}

Path parameters

idstring required

The ID of the pack.

Example:3c42c847-eb30-4452-80e0-728584042334

The pack ID.

Request body

descriptionstring

The pack description.

enabledboolean

Enables the pack.

intervalinteger

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

namestring

The pack name.

policy_idsstring[]

A list of agents policy IDs.

queriesSecurityOsqueryAPIObjectQueries

An object of queries.

schedule_type'interval' | 'rrule'

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

shardsSecurityOsqueryAPIShards

An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Example request

{
  "name": "updated_my_pack_name"
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "updated_my_pack_name",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": {
      "47638692-7c4c-4053-aa3e-7186f28df349": 35,
      "5e267651-fe50-443e-8d3f-3bbc9171b618": 58
    },
    "updated_at": "2025-02-26T13:40:16.297Z",
    "updated_by": "elastic",
    "version": 1
  }
}