Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Update a saved query

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>

Refer to Spaces for more information.

Update a saved query using the query ID.

info You cannot update a prebuilt saved query.

put/api/osquery/saved_queries/{id}

Path parameters

idstring required

The ID of a saved query.

Example:3c42c847-eb30-4452-80e0-728584042334

The saved query ID.

Request body

descriptionstring

The saved query description.

ecs_mappingSecurityOsqueryAPIECSMapping

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

idstring

The ID of a saved query.

intervalstring

An interval, in seconds, on which to run the query.

platformstring

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

querystring

The SQL query you want to run.

removedboolean

Indicates whether the query is removed.

snapshotboolean

Indicates whether the query is a snapshot.

versionstring

Uses the Osquery versions greater than or equal to the specified version string.

Example request

{
  "id": "updated_my_saved_query_name"
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "Saved query description",
    "id": "updated_my_saved_query_name",
    "interval": "60",
    "query": "select * from uptime;",
    "saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
    "updated_at": "2025-02-26T13:40:16.297Z",
    "updated_by": "elastic",
    "version": "WzQzMTcsMV0="
  }
}