v1

latestOpenAPI 3.0.02026-07-14512083.9 KB

Create a new Live query campaign

post/live_queries

Request body

targeted_device_idsinteger[]

Target Devices in Live Query

target_all_devicesboolean

Target All Devices in Live Query

target_macsboolean

Target all MacOS devices in Live Query

target_windows_devicesboolean

Target all windows devices in Live Query

target_linux_devicesboolean

Target all Linux devices in Live Query

sqlstring

The sql to be run on all targeted devices

namestring

The title of the live query

Response

The newly created Live query campaign

idstring

The canonical identifier for this live query campaign

osquery_sqlstring

The sql to be run on all targeted devices

namestring

The title of the live query

created_atstring date-time

The creation timestamp of the live query campaign

publishedboolean

Describes whether or not the author of the LQ has published the live query (true) or if it is still a draft (false)

revisioninteger

Editing a Live Query results in it's revision being incremented. When the live query's revision is incremented, it causes the live query to be re-run on all target devices

successful_devices_countinteger

The number of device that have successfully run the query

errored_devices_countinteger

The number of device that returned an error when attempting to run the query

waiting_devices_countinteger

The number of device that have not yet reported results or errors running the device

tables_usedstring

The names of the tables referenced in the osquery SQL