Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Create a saved query

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>

Refer to Spaces for more information.

Create and save a query for later use.

post/api/osquery/saved_queries

Request body

descriptionstring

The saved query description.

ecs_mappingSecurityOsqueryAPIECSMapping

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

idstring

The ID of a saved query.

intervalstring

An interval, in seconds, on which to run the query.

platformstring

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

querystring

The SQL query you want to run.

removedboolean

Indicates whether the query is removed.

snapshotboolean

Indicates whether the query is a snapshot.

versionstring

Uses the Osquery versions greater than or equal to the specified version string.

Example request

{
  "description": "Saved query description",
  "ecs_mapping": {
    "host.uptime": {
      "field": "total_seconds"
    }
  },
  "id": "saved_query_id",
  "interval": "60",
  "platform": "linux,darwin",
  "query": "select * from uptime;",
  "timeout": 120,
  "version": "2.8.0"
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "Saved query description",
    "ecs_mapping": {
      "host.uptime": {
        "field": "total_seconds"
      }
    },
    "id": "saved_query_id",
    "interval": "60",
    "platform": "linux,darwin",
    "prebuilt": false,
    "query": "select * from uptime;",
    "saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
    "timeout": 120,
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic",
    "version": "2.8.0"
  }
}