Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Create a pack

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>

Refer to Spaces for more information.

Create a query pack.

post/api/osquery/packs

Request body

descriptionstring

The pack description.

enabledboolean

Enables the pack.

intervalinteger

Pack-level interval, in seconds. Used when schedule_type is interval. Mutually exclusive with rrule_schedule.

namestring

The pack name.

policy_idsstring[]

A list of agents policy IDs.

queriesSecurityOsqueryAPIObjectQueries

An object of queries.

schedule_type'interval' | 'rrule'

Discriminator for the pack's schedule mode. interval uses native osqueryd interval scheduling (seconds). rrule uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.

shardsSecurityOsqueryAPIShards

An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Example request

{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id",
    "fleet-server-policy"
  ],
  "queries": {
    "my_query": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        },
        "tags": {
          "value": [
            "tag1",
            "tag2"
          ]
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  },
  "shards": {
    "fleet-server-policy": 58,
    "my_policy_id": 35
  }
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": {
      "47638692-7c4c-4053-aa3e-7186f28df349": 35,
      "5e267651-fe50-443e-8d3f-3bbc9171b618": 58
    },
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic",
    "version": 1
  }
}