openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Osquery API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Run live queries, manage packs and saved queries.
  name: Security Osquery API
  x-displayName: Security Osquery
paths:
  /api/osquery/history:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/history</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

        '
      operationId: OsqueryGetUnifiedHistory
      parameters:
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          default: 20
          description: The number of results to return per page.
          maximum: 100
          minimum: 1
          type: integer
      - description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
        in: query
        name: nextPage
        required: false
        schema:
          description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
          type: string
      - description: A search string to filter history entries by pack name, query text, or query ID.
        in: query
        name: kuery
        required: false
        schema:
          description: A search string to filter history entries by pack name, query text, or query ID.
          type: string
      - description: Comma-separated list of user IDs to filter live query history.
        in: query
        name: userIds
        required: false
        schema:
          description: Comma-separated list of user IDs to filter live query history.
          example: elastic,admin
          type: string
      - description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
        in: query
        name: sourceFilters
        required: false
        schema:
          description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
          example: live,scheduled
          type: string
      - description: The start of the time range filter (ISO 8601).
        in: query
        name: startDate
        required: false
        schema:
          description: The start of the time range filter (ISO 8601).
          example: '2024-01-01T00:00:00Z'
          type: string
      - description: The end of the time range filter (ISO 8601).
        in: query
        name: endDate
        required: false
        schema:
          description: The end of the time range filter (ISO 8601).
          example: '2024-12-31T23:59:59Z'
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                unifiedHistoryExample:
                  summary: Example unified history response
                  value:
                    data:
                    - actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                      agentCount: 5
                      errorCount: 0
                      id: 3c42c847-eb30-4452-80e0-728584042334
                      queryName: uptime_query
                      queryText: select * from uptime;
                      source: Live
                      sourceType: live
                      successCount: 5
                      timestamp: '2024-07-26T09:59:32.220Z'
                      totalRows: 42
                      userId: elastic
                    - agentCount: 10
                      errorCount: 1
                      executionCount: 3
                      id: pack_my_pack_uptime_3
                      packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                      packName: My Pack
                      plannedTime: '2024-07-26T09:00:00.000Z'
                      queryName: uptime
                      queryText: select * from uptime;
                      scheduleId: pack_my_pack_uptime
                      source: Scheduled
                      sourceType: scheduled
                      successCount: 9
                      timestamp: '2024-07-26T09:00:00.000Z'
                      totalRows: 100
                    hasMore: true
                    nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetUnifiedHistoryResponse'
          description: Indicates a successful call.
      summary: Get unified query history
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/live_queries:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all live queries.'
      operationId: OsqueryFindLiveQueries
      parameters:
      - description: A KQL search string to filter live queries.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryResponse'
          description: Indicates a successful call.
      summary: Get live queries
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create and run a live query.'
      operationId: OsqueryCreateLiveQuery
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse'
          description: Indicates a successful call.
      summary: Create a live query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/live_queries/{id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a live query using the query ID.'
      operationId: OsqueryGetLiveQueryDetails
      parameters:
      - description: The ID of the live query.
        in: path
        name: id
        required: true
        schema:
          description: The ID of the live query result you want to retrieve.
          example: 3c42c847-eb30-4452-80e0-728584042334
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse'
          description: Indicates a successful call.
      summary: Get live query details
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/live_queries/{id}/results/{actionId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the results of a live query using the query action ID.'
      operationId: OsqueryGetLiveQueryResults
      parameters:
      - description: The ID of the live query.
        in: path
        name: id
        required: true
        schema:
          description: The ID of the live query result you want to retrieve.
          example: 3c42c847-eb30-4452-80e0-728584042334
          type: string
      - description: The ID of the query action.
        in: path
        name: actionId
        required: true
        schema:
          description: The ID of the query action that generated the live query results.
          example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
          type: string
      - description: A KQL search string to filter results.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse'
          description: Indicates a successful call.
      summary: Get live query results
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/packs:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all query packs.'
      operationId: OsqueryFindPacks
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPacksResponse'
          description: Indicates a successful call.
      summary: Get packs
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a query pack.'
      operationId: OsqueryCreatePacks
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreatePacksRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreatePacksResponse'
          description: Indicates a successful call.
      summary: Create a pack
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/packs/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a query pack using the pack ID.'
      operationId: OsqueryDeletePacks
      parameters:
      - description: The pack ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              schema:
                example: {}
                type: object
                properties: {}
          description: Indicates a successful call.
      summary: Delete a pack
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a query pack using the pack ID.'
      operationId: OsqueryGetPacksDetails
      parameters:
      - description: The pack ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPackResponse'
          description: Indicates a successful call.
      summary: Get pack details
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a query pack using the pack ID.

        > info

        > You cannot update a prebuilt pack.

        '
      operationId: OsqueryUpdatePacks
      parameters:
      - description: The pack ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksResponse'
          description: Indicates a successful call.
      summary: Update a pack
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/packs/{id}/copy:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}/copy</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `false`.'
      operationId: OsqueryCopyPacks
      parameters:
      - description: The ID of the pack to copy.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              examples:
                copyPackExample:
                  summary: Example response for copying a pack
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: false
                      name: my_pack_copy
                      policy_ids: []
                      queries:
                      - ecs_mapping:
                        - key: client.port
                          value:
                            field: port
                        id: ports
                        interval: 60
                        query: SELECT * FROM listening_ports;
                        removed: false
                        snapshot: true
                        timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: []
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopyPacksResponse'
          description: Indicates a successful call.
      summary: Copy a pack
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/saved_queries:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all saved queries.'
      operationId: OsqueryFindSavedQueries
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryResponse'
          description: Indicates a successful call.
      summary: Get saved queries
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create and save a query for later use.'
      operationId: OsqueryCreateSavedQuery
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryResponse'
          description: Indicates a successful call.
      summary: Create a saved query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/saved_queries/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a saved query using the query ID.'
      operationId: OsqueryDeleteSavedQuery
      parameters:
      - description: The saved query ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_DefaultSuccessResponse'
          description: Indicates a successful call.
      summary: Delete a saved query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a saved query using the query ID.'
      operationId: OsqueryGetSavedQueryDetails
      parameters:
      - description: The saved query ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryDetailResponse'
          description: Indicates a successful call.
      summary: Get saved query details
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a saved query using the query ID.

        > info

        > You cannot update a prebuilt saved query.

        '
      operationId: OsqueryUpdateSavedQuery
      parameters:
      - description: The saved query ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryResponse'
          description: Indicates a successful call.
      summary: Update a saved query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/saved_queries/{id}/copy:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}/copy</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a copy of a saved query with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`).'
      operationId: OsqueryCopySavedQuery
      parameters:
      - description: The ID of the saved query to copy.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              examples:
                copySavedQueryExample:
                  summary: Example response for copying a saved query
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query_copy
                      interval: '60'
                      platform: linux,darwin
                      query: select * from uptime;
                      removed: false
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      snapshot: true
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopySavedQueryResponse'
          description: Indicates a successful call.
      summary: Copy a saved query
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/scheduled_results/{scheduleId}/{executionCount}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

        '
      operationId: OsqueryGetScheduledActionResults
      parameters:
      - description: The schedule ID of the scheduled query.
        in: path
        name: scheduleId
        required: true
        schema:
          description: The schedule ID of the scheduled query.
          example: pack_my_pack_uptime
          type: string
      - description: The execution count for this scheduled query run.
        in: path
        name: executionCount
        required: true
        schema:
          description: The execution count for this scheduled query run.
          example: 3
          type: integer
      - description: The kuery to filter the results by.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return. The default is 1.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page. The default is 20.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field that is used to sort the results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: Specifies the sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                scheduledActionResultsExample:
                  summary: Example scheduled action results response
                  value:
                    aggregations:
                      failed: 1
                      pending: 0
                      successful: 9
                      totalResponded: 10
                      totalRowCount: 42
                    currentPage: 0
                    edges:
                    - _id: result-001
                      fields:
                        agent_id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                        rows_count: 5
                        status: success
                    metadata:
                      executionCount: 3
                      packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                      packName: My Pack
                      queryName: uptime
                      queryText: select * from uptime;
                      scheduleId: pack_my_pack_uptime
                      timestamp: '2024-07-26T09:00:00.000Z'
                    pageSize: 20
                    total: 10
                    totalPages: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetScheduledActionResultsResponse'
          description: Indicates a successful call.
      summary: Get scheduled action results
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

        '
      operationId: OsqueryGetScheduledQueryResults
      parameters:
      - description: The schedule ID of the scheduled query.
        in: path
        name: scheduleId
        required: true
        schema:
          description: The schedule ID of the scheduled query.
          example: pack_my_pack_uptime
          type: string
      - description: The execution count for this scheduled query run.
        in: path
        name: executionCount
        required: true
        schema:
          description: The execution count for this scheduled query run.
          example: 3
          type: integer
      - description: The kuery to filter the results by.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return. The default is 1.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page. The default is 20.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field that is used to sort the results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: Specifies the sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      - description: The start date filter (ISO 8601) to narrow down results.
        in: query
        name: startDate
        required: false
        schema:
          description: The start date filter (ISO 8601) to narrow down results.
          example: '2024-01-01T00:00:00Z'
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                scheduledQueryResultsExample:
                  summary: Example scheduled query results response
                  value:
                    data:
                      edges:
                      - _id: row-001
                        fields:
                          host.uptime:
                          - '12345'
                      - _id: row-002
                        fields:
                          host.uptime:
                          - '67890'
                      total: 2
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetScheduledQueryResultsResponse'
          description: Indicates a successful call.
      summary: Get scheduled query results
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Osquery_API_FindSavedQueryResponse:
      description: A paginated list of saved queries.
      example:
        data:
        - created_at: '2022-07-26T09:28:08.597Z'
          created_by: elastic
          created_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: saved_query_id
          interval: '60'
          platform: linux,darwin
          prebuilt: false
          query: select * from uptime;
          saved_object_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
          updated_at: '2022-07-26T09:28:08.597Z'
          updated_by: elastic
          updated_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          version: 2.8.0
        page: 1
        per_page: 100
        total: 11
      type: object
      properties:
        data:
          description: An array of saved query objects.
          items:
            type: object
            properties:
              created_at:
                format: date-time
                type: string
              created_by:
                nullable: true
                type: string
              created_by_profile_uid:
                type: string
              description:
                $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
              ecs_mapping:
                $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
              id:
                $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
              interval:
                oneOf:
                - type: integer
                - type: string
              platform:
                $ref: '#/components/schemas/Security_Osquery_API_Platform'
              prebuilt:
                type: boolean
              query:
                $ref: '#/components/schemas/Security_Osquery_API_Query'
              removed:
                $ref: '#/components/schemas/Security_Osquery_API_Removed'
              saved_object_id:
                type: string
              snapshot:
                $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
              timeout:
                type: integer
              updated_at:
                format: date-time
                type: string
              updated_by:
                nullable: true
                type: string
              updated_by_profile_uid:
                type: string
              version:
                oneOf:
                - type: integer
                - type: string
            required:
            - saved_object_id
            - id
          type: array
        page:
          description: The current page number.
          type: integer
        per_page:
          description: The number of results per page.
          type: integer
        total:
          description: The total number of saved queries.
          type: integer
      required:
      - page
      - per_page
      - total
      - data
    Security_Osquery_API_CreatePacksResponse:
      description: The response for creating a pack.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: My pack
          enabled: true
          name: my_pack
          policy_ids:
          - my_policy_id
          queries:
            ports:
              ecs_mapping:
                client.port:
                  field: port
              interval: 60
              query: SELECT * FROM listening_ports;
              removed: false
              snapshot: true
              timeout: 120
          saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
          shards:
            47638692-7c4c-4053-aa3e-7186f28df349: 35
            5e267651-fe50-443e-8d3f-3bbc9171b618: 58
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
          version: 1
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              description: The date and time the pack was created.
              format: date-time
              type: string
            created_by:
              description: The user who created the pack.
              nullable: true
              type: string
            created_by_profile_uid:
              description: The profile UID of the user who created the pack.
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
            saved_object_id:
              description: The saved object ID of the pack.
              type: string
            shards:
              description: Shard configuration as an array of key-value pairs.
              items:
                type: object
                properties:
                  key:
                    type: string
                  value:
                    type: number
              type: array
            updated_at:
              description: The date and time the pack was last updated.
              format: date-time
              type: string
            updated_by:
              description: The user who last updated the pack.
              nullable: true
              type: string
            updated_by_profile_uid:
              description: The profile UID of the user who last updated the pack.
              type: string
            version:
              description: The pack version number.
              type: integer
          required:
          - saved_object_id
          - name
      required:
      - data
    Security_Osquery_API_Query:
      description: The SQL query you want to run.
      example: select * from uptime;
      type: string
    Security_Osquery_API_Platform:
      description: Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.
      example: linux,darwin
      type: string
    Security_Osquery_API_SortOrderOrUndefined:
      description: Specifies the sort order.
      enum:
      - asc
      - desc
      example: desc
      type: string
    Security_Osquery_API_UpdateSavedQueryRequestBody:
      example:
        id: updated_my_saved_query_name
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
        interval:
          $ref: '#/components/schemas/Security_Osquery_API_Interval'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Osquery_API_CopySavedQueryResponse:
      description: The response for copying a saved query.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: my_saved_query_copy
          interval: '60'
          platform: linux,darwin
          query: select * from uptime;
          removed: false
          saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
          snapshot: true
          timeout: 120
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              oneOf:
              - type: integer
              - type: string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
          required:
          - saved_object_id
          - id
      required:
      - data
    Security_Osquery_API_PolicyIds:
      description: A list of agents policy IDs.
      example:
      - policyId1
      - policyId2
      items:
        type: string
      type: array
    Security_Osquery_API_ECSMappingItem:
      type: object
      properties:
        field:
          description: The ECS field to map to.
          example: host.uptime
          type: string
        value:
          description: The value to map to the ECS field.
          example: total_seconds
          oneOf:
          - type: string
          - items:
              type: string
            type: array
    Security_Osquery_API_ObjectQueries:
      additionalProperties:
        $ref: '#/components/schemas/Security_Osquery_API_ObjectQueriesItem'
      description: An object of queries.
      type: object
    Security_Osquery_API_ECSMappingArray:
      description: ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).
      items:
        $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArrayItem'
      type: array
    Security_Osquery_API_PackId:
      description: The ID of the pack.
      example: 3c42c847-eb30-4452-80e0-728584042334
      type: string
    Security_Osquery_API_UpdateSavedQueryResponse:
      description: The response for updating a saved query.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: Saved query description
          id: updated_my_saved_query_name
          interval: '60'
          query: select * from uptime;
          saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
          updated_at: '2025-02-26T13:40:16.297Z'
          updated_by: elastic
          version: WzQzMTcsMV0=
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              oneOf:
              - type: integer
              - type: string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            prebuilt:
              type: boolean
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
            version:
              description: The saved query version.
              type: string
          required:
          - saved_object_id
          - id
      required:
      - data
    Security_Osquery_API_LiveHistoryRow:
      allOf:
      - $ref: '#/components/schemas/Security_Osquery_API_UnifiedHistoryRowBase'
      - type: object
        properties:
          actionId:
            description: The Fleet action ID for the live query.
            type: string
          agentAll:
            description: Whether the query targeted all agents.
            type: boolean
          agentIds:
            description: List of targeted agent IDs.
            items:
              type: string
            type: array
          agentPlatforms:
            description: List of targeted agent platforms.
            items:
              type: string
            type: array
          agentPolicyIds:
            description: List of targeted agent policy IDs.
            items:
              type: string
            type: array
          ecsMapping:
            additionalProperties: true
            description: ECS mapping configuration used for the query.
            type: object
          queriesTotal:
            description: The total number of sub-queries in the live action.
            type: integer
          queriesWithResults:
            description: The number of sub-queries that returned results.
            type: integer
          savedQueryId:
            description: The saved query ID, if the live query was based on a saved query.
            type: string
          source:
            description: Whether this was a manually run live query or triggered by a rule.
            enum:
            - Live
            - Rule
            type: string
          sourceType:
            description: Identifies this as a live query history row.
            enum:
            - live
            type: string
          timeout:
            description: The query timeout in seconds.
            type: integer
          userId:
            description: The ID of the user who ran the query.
            type: string
          userProfileUid:
            description: The user profile UID of the user who ran the query.
            type: string
        required:
        - sourceType
        - source
    Security_Osquery_API_FindLiveQueryResponse:
      example:
        data:
          items:
          - _source:
              '@timestamp': '2023-10-31T00:00:00Z'
              action_id: 3c42c847-eb30-4452-80e0-728584042334
              agents:
              - 16d7caf5-efd2-4212-9b62-73dafc91fa13
              expiration: '2023-10-31T00:00:00Z'
              queries:
              - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                agents:
                - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                ecs_mapping:
                  host.uptime:
                    field: total_seconds
                id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                query: select * from uptime;
                saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
              result_counts:
                error_agents: 0
                responded_agents: 1
                successful_agents: 1
                total_rows: 42
              user_id: elastic
          total: 1
      type: object
      properties:
        data:
          type: object
          properties:
            items:
              description: An array of live query action items.
              items:
                type: object
                properties:
                  _source:
                    type: object
                    properties:
                      '@timestamp':
                        format: date-time
                        type: string
                      action_id:
                        type: string
                      agents:
                        items:
                          type: string
                        type: array
                      expiration:
                        format: date-time
                        type: string
                      pack_id:
                        type: string
                      queries:
                        items:
                          type: object
                          properties:
                            action_id:
                              type: string
                            agents:
                              items:
                                type: string
                              type: array
                            ecs_mapping:
                              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
                            id:
                              type: string
                            query:
                              type: string
                            saved_query_id:
                              type: string
                        type: array
                      result_counts:
                        description: Result count statistics (present when withResultCounts is true).
                        type: object
                        properties:
                          error_agents:
                            type: integer
                          responded_agents:
                            type: integer
                          successful_agents:
                            type: integer
                          total_rows:
                            type: integer
                      user_id:
                        type: string
              type: array
            total:
              description: The total number of live queries.
              type: integer
    Security_Osquery_API_KueryOrUndefined:
      description: The kuery to filter the results by.
      example: 'agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13'
      nullable: true
      type: string
    Security_Osquery_API_UnifiedHistoryRowBase:
      type: object
      properties:
        agentCount:
          description: The number of agents targeted by the query.
          type: integer
        errorCount:
          description: The number of agent responses with errors.
          nullable: true
          type: integer
        id:
          description: Unique identifier for the history row.
          type: string
        packId:
          description: The ID of the pack containing the query.
          type: string
        packName:
          description: The name of the pack containing the query.
          type: string
        queryName:
          description: The name of the query, if available.
          type: string
        queryText:
          description: The SQL query that was executed.
          type: string
        spaceId:
          description: The Kibana space ID where the query was executed.
          type: string
        successCount:
          description: The number of successful agent responses.
          nullable: true
          type: integer
        timestamp:
          description: The timestamp of the query execution.
          type: string
        totalRows:
          description: The total number of result rows returned across all agents.
          nullable: true
          type: integer
      required:
      - id
      - timestamp
      - queryText
      - agentCount
    Security_Osquery_API_DefaultSuccessResponse:
      example: {}
      type: object
      properties: {}
    Security_Osquery_API_UnifiedHistoryRow:
      discriminator:
        mapping:
          live: '#/components/schemas/Security_Osquery_API_LiveHistoryRow'
          scheduled: '#/components/schemas/Security_Osquery_API_ScheduledHistoryRow'
        propertyName: sourceType
      oneOf:
      - $ref: '#/components/schemas/Security_Osquery_API_LiveHistoryRow'
      - $ref: '#/components/schemas/Security_Osquery_API_ScheduledHistoryRow'
    Security_Osquery_API_ScheduledActionResultsAggregations:
      type: object
      properties:
        failed:
          description: The number of agents that returned errors.
          type: integer
        pending:
          description: The number of agents with pending responses.
          type: integer
        successful:
          description: The number of agents that completed successfully.
          type: integer
        totalResponded:
          description: The total number of agents that responded.
          type: integer
        totalRowCount:
          description: The total number of result rows across all agents.
          type: integer
    Security_Osquery_API_Interval:
      description: An interval, in seconds, on which to run the query.
      example: '60'
      type: string
    Security_Osquery_API_FindPacksResponse:
      description: A paginated list of query packs.
      example:
        data:
        - created_at: '2023-10-31T00:00:00Z'
          created_by: elastic
          created_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          description: My pack description
          enabled: true
          name: My Pack
          policy_ids: []
          queries:
          - ecs_mapping:
            - key: host.uptime
              value:
                field: total_seconds
            id: uptime
            interval: 3600
            query: select * from uptime;
          read_only: false
          saved_object_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
          updated_at: '2023-10-31T00:00:00Z'
          updated_by: elastic
          updated_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        page: 1
        per_page: 10
        total: 1
      type: object
      properties:
        data:
          description: An array of pack objects.
          items:
            type: object
            properties:
              created_at:
                format: date-time
                type: string
              created_by:
                nullable: true
                type: string
              created_by_profile_uid:
                type: string
              description:
                $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
              enabled:
                $ref: '#/components/schemas/Security_Osquery_API_Enabled'
              name:
                $ref: '#/components/schemas/Security_Osquery_API_PackName'
              policy_ids:
                $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
              queries:
                description: 'Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.'
                items:
                  type: object
                  properties:
                    ecs_mapping:
                      $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArray'
                    id:
                      type: string
                    interval:
                      type: integer
                    platform:
                      type: string
                    query:
                      type: string
                    removed:
                      type: boolean
                    snapshot:
                      type: boolean
                    timeout:
                      type: integer
                    version:
                      type: string
                type: array
              read_only:
                description: Whether the pack is read-only (true for prebuilt packs).
                type: boolean
              saved_object_id:
                description: The saved object ID of the pack.
                type: string
              updated_at:
                format: date-time
                type: string
              updated_by:
                nullable: true
                type: string
              updated_by_profile_uid:
                type: string
              version:
                description: The pack version number.
                type: integer
            required:
            - saved_object_id
            - name
          type: array
        page:
          description: The current page number.
          type: integer
        per_page:
          description: The number of results per page.
          type: integer
        total:
          description: The total number of packs.
          type: integer
      required:
      - page
      - per_page
      - total
      - data
    Security_Osquery_API_FindLiveQueryDetailsResponse:
      example:
        data:
          '@timestamp': '2022-07-26T09:59:32.220Z'
          action_id: 3c42c847-eb30-4452-80e0-728584042334
          agents:
          - 16d7caf5-efd2-4212-9b62-73dafc91fa13
          expiration: '2022-07-26T10:04:32.220Z'
          queries:
          - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
            agents:
            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
            docs: 0
            ecs_mapping:
              host.uptime:
                field: total_seconds
            failed: 1
            id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
            pending: 0
            query: select * from uptime;
            responded: 1
            saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
            status: completed
            successful: 0
          status: completed
          user_id: elastic
      type: object
      properties:
        data:
          type: object
          properties:
            '@timestamp':
              format: date-time
              type: string
            action_id:
              type: string
            agents:
              items:
                type: string
              type: array
            expiration:
              format: date-time
              type: string
            pack_id:
              type: string
            pack_name:
              type: string
            prebuilt_pack:
              type: boolean
            queries:
              description: The queries with their execution status.
              items:
                type: object
                properties:
                  action_id:
                    type: string
                  agents:
                    items:
                      type: string
                    type: array
                  docs:
                    description: Number of result documents.
                    type: integer
                  ecs_mapping:
                    $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
                  failed:
                    description: Number of failed queries.
                    type: integer
                  id:
                    type: string
                  pending:
                    description: Number of pending agents.
                    type: integer
                  query:
                    type: string
                  responded:
                    description: Total responded agents.
                    type: integer
                  saved_query_id:
                    type: string
                  status:
                    description: Status of this individual query.
                    enum:
                    - completed
                    - running
                    type: string
                  successful:
                    description: Number of successful agents.
                    type: integer
              type: array
            status:
              description: Global status of the live query (completed, running).
              enum:
              - completed
              - running
              type: string
            tags:
              items:
                type: string
              type: array
            user_id:
              type: string
            user_profile_uid:
              type: string
    Security_Osquery_API_UpdatePacksRequestBody:
      example:
        name: updated_my_pack_name
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
        enabled:
          $ref: '#/components/schemas/Security_Osquery_API_Enabled'
        name:
          $ref: '#/components/schemas/Security_Osquery_API_PackName'
        policy_ids:
          $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
        queries:
          $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
        shards:
          $ref: '#/components/schemas/Security_Osquery_API_Shards'
    Security_Osquery_API_FindPackResponse:
      description: The details of a single query pack.
      example:
        data:
          created_at: '2022-07-25T19:41:10.263Z'
          created_by: elastic
          description: ''
          enabled: true
          name: test_pack
          namespaces:
          - default
          policy_ids: []
          queries:
            uptime:
              ecs_mapping:
                message:
                  field: days
              interval: 3600
              query: select * from uptime
          read_only: false
          saved_object_id: 3c42c847-eb30-4452-80e0-728584042334
          shards: {}
          type: osquery-pack
          updated_at: '2022-07-25T20:12:01.455Z'
          updated_by: elastic
          version: 1
      type: object
      properties:
        data:
          description: The pack details.
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            namespaces:
              description: The namespaces the pack belongs to.
              items:
                type: string
              type: array
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
            read_only:
              description: Whether the pack is read-only (true for prebuilt packs).
              type: boolean
            saved_object_id:
              description: The saved object ID of the pack.
              type: string
            shards:
              $ref: '#/components/schemas/Security_Osquery_API_Shards'
            type:
              description: The saved object type.
              type: string
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
            version:
              description: The pack version number.
              type: integer
          required:
          - saved_object_id
          - name
      required:
      - data
    Security_Osquery_API_Version:
      description: Uses the Osquery versions greater than or equal to the specified version string.
      example: 1.0.0
      type: string
    Security_Osquery_API_CopyPacksResponse:
      description: The response for copying a pack.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: My pack
          enabled: false
          name: my_pack_copy
          policy_ids: []
          queries:
          - ecs_mapping:
            - key: client.port
              value:
                field: port
            id: ports
            interval: 60
            query: SELECT * FROM listening_ports;
            removed: false
            snapshot: true
            timeout: 120
          saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
          shards: []
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              description: 'Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.'
              items:
                type: object
                properties:
                  ecs_mapping:
                    $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArray'
                  id:
                    type: string
                  interval:
                    type: integer
                  platform:
                    type: string
                  query:
                    type: string
                  removed:
                    type: boolean
                  snapshot:
                    type: boolean
                  timeout:
                    type: integer
                  version:
                    type: string
              type: array
            saved_object_id:
              description: The saved object ID of the copied pack.
              type: string
            shards:
              description: Shard configuration as an array of key-value pairs.
              items:
                type: object
                properties:
                  key:
                    type: string
                  value:
                    type: number
              type: array
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
            version:
              description: The pack version number.
              type: integer
          required:
          - saved_object_id
          - name
      required:
      - data
    Security_Osquery_API_PageOrUndefined:
      description: The page number to return. The default is 1.
      example: 1
      nullable: true
      type: integer
    Security_Osquery_API_CreatePacksRequestBody:
      example:
        description: My pack
        enabled: true
        name: my_pack
        policy_ids:
        - my_policy_id
        - fleet-server-policy
        queries:
          my_query:
            ecs_mapping:
              client.port:
                field: port
              tags:
                value:
                - tag1
                - tag2
            interval: 60
            query: SELECT * FROM listening_ports;
            timeout: 120
        shards:
          fleet-server-policy: 58
          my_policy_id: 35
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
        enabled:
          $ref: '#/components/schemas/Security_Osquery_API_Enabled'
        name:
          $ref: '#/components/schemas/Security_Osquery_API_PackName'
        policy_ids:
          $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
        queries:
          $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
        shards:
          $ref: '#/components/schemas/Security_Osquery_API_Shards'
    Security_Osquery_API_ScheduledHistoryRow:
      allOf:
      - $ref: '#/components/schemas/Security_Osquery_API_UnifiedHistoryRowBase'
      - type: object
        properties:
          executionCount:
            description: The execution count for this scheduled query run.
            type: integer
          plannedTime:
            description: The planned execution time for the scheduled query.
            type: string
          scheduleId:
            description: The schedule ID for the scheduled query.
            type: string
          source:
            description: Indicates this is a scheduled query execution.
            enum:
            - Scheduled
            type: string
          sourceType:
            description: Identifies this as a scheduled query history row.
            enum:
            - scheduled
            type: string
        required:
        - sourceType
        - source
    Security_Osquery_API_CreateSavedQueryRequestBody:
      example:
        description: Saved query description
        ecs_mapping:
          host.uptime:
            field: total_seconds
        id: saved_query_id
        interval: '60'
        platform: linux,darwin
        query: select * from uptime;
        timeout: 120
        version: 2.8.0
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
        interval:
          $ref: '#/components/schemas/Security_Osquery_API_Interval'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Osquery_API_ArrayQueriesItem:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_QueryId'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Osquery_API_FindSavedQueryDetailResponse:
      description: The details of a single saved query.
      example:
        data:
          created_at: '2022-07-26T09:28:08.597Z'
          created_by: elastic
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: saved_query_id
          interval: '60'
          platform: linux,darwin
          prebuilt: false
          query: select * from uptime;
          saved_object_id: 3c42c847-eb30-4452-80e0-728584042334
          updated_at: '2022-07-26T09:28:08.597Z'
          updated_by: elastic
          version: 2.8.0
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              oneOf:
              - type: integer
              - type: string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            prebuilt:
              type: boolean
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
            version:
              oneOf:
              - type: integer
              - type: string
          required:
          - saved_object_id
          - id
      required:
      - data
    Security_Osquery_API_CreateLiveQueryRequestBody:
      example:
        agent_all: true
        ecs_mapping:
          host.uptime:
            field: total_seconds
        query: select * from uptime;
      type: object
      properties:
        agent_all:
          description: When `true`, the query runs on all agents.
          type: boolean
        agent_ids:
          description: A list of agent IDs to run the query on.
          items:
            type: string
          type: array
        agent_platforms:
          description: A list of agent platforms to run the query on.
          items:
            type: string
          type: array
        agent_policy_ids:
          description: A list of agent policy IDs to run the query on.
          items:
            type: string
          type: array
        alert_ids:
          description: A list of alert IDs associated with the live query.
          items:
            type: string
          type: array
        case_ids:
          description: A list of case IDs associated with the live query.
          items:
            type: string
          type: array
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        event_ids:
          description: A list of event IDs associated with the live query.
          items:
            type: string
          type: array
        metadata:
          description: Custom metadata object associated with the live query.
          nullable: true
          type: object
        pack_id:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
        queries:
          $ref: '#/components/schemas/Security_Osquery_API_ArrayQueries'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        saved_query_id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
    Security_Osquery_API_CreateSavedQueryResponse:
      description: The response for creating a saved query.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: saved_query_id
          interval: '60'
          platform: linux,darwin
          prebuilt: false
          query: select * from uptime;
          saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
          timeout: 120
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
          version: 2.8.0
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              description: An interval, in seconds, on which to run the query. May be returned as number or string.
              oneOf:
              - type: integer
              - type: string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            prebuilt:
              description: Whether the saved query is prebuilt.
              type: boolean
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              description: The saved object ID of the saved query.
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              description: The query timeout in seconds.
              type: integer
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
            version:
              description: The saved query version.
              oneOf:
              - type: integer
              - type: string
          required:
          - saved_object_id
          - id
      required:
      - data
    Security_Osquery_API_PackDescription:
      description: The pack description.
      example: Pack description
      type: string
    Security_Osquery_API_SavedQueryDescription:
      description: The saved query description.
      example: Saved query description
      type: string
    Security_Osquery_API_ArrayQueries:
      description: An array of queries to run.
      items:
        $ref: '#/components/schemas/Security_Osquery_API_ArrayQueriesItem'
      type: array
    Security_Osquery_API_ObjectQueriesItem:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_QueryId'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        saved_query_id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Osquery_API_ScheduledExecutionMetadata:
      description: Execution metadata resolved from the pack saved object.
      type: object
      properties:
        executionCount:
          description: The execution count for this scheduled query run.
          type: integer
        packId:
          description: The ID of the pack containing the query.
          type: string
        packName:
          description: The name of the pack containing the query.
          type: string
        queryName:
          description: The name of the query within the pack.
          type: string
        queryText:
          description: The SQL query that was executed.
          type: string
        scheduleId:
          description: The schedule ID for the scheduled query.
          type: string
        timestamp:
          description: The timestamp of the most recent response for this execution.
          type: string
    Security_Osquery_API_Shards:
      additionalProperties:
        type: number
      description: An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
      example:
        policy_id: 50
      type: object
    Security_Osquery_API_CreateLiveQueryResponse:
      description: The response for creating a live query.
      example:
        data:
          '@timestamp': '2022-07-26T09:59:32.220Z'
          action_id: 3c42c847-eb30-4452-80e0-728584042334
          agent_all: true
          agent_ids: []
          agent_platforms: []
          agent_policy_ids: []
          agents:
          - 16d7caf5-efd2-4212-9b62-73dafc91fa13
          expiration: '2022-07-26T10:04:32.220Z'
          input_type: osquery
          metadata:
            execution_context:
              name: osquery
              url: /app/osquery/live_queries/new
          queries:
          - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
            agents:
            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
            ecs_mapping:
              host.uptime:
                field: total_seconds
            id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
            query: select * from uptime;
            timeout: 120
          type: INPUT_ACTION
          user_id: elastic
      type: object
      properties:
        data:
          type: object
          properties:
            '@timestamp':
              description: The timestamp when the action was created.
              format: date-time
              type: string
            action_id:
              description: The ID of the action.
              type: string
            agent_all:
              description: Whether the query targets all agents.
              type: boolean
            agent_ids:
              description: The agent IDs targeted by the action.
              items:
                type: string
              type: array
            agent_platforms:
              description: The agent platforms targeted.
              items:
                type: string
              type: array
            agent_policy_ids:
              description: The agent policy IDs targeted.
              items:
                type: string
              type: array
            agents:
              description: The resolved list of agent IDs.
              items:
                type: string
              type: array
            expiration:
              description: The expiration date of the action.
              format: date-time
              type: string
            input_type:
              description: The input type.
              type: string
            metadata:
              description: Custom metadata associated with the action.
              type: object
            pack_id:
              description: The pack ID if the query was run from a pack.
              type: string
            queries:
              description: The queries in this action.
              items:
                type: object
                properties:
                  action_id:
                    type: string
                  agents:
                    items:
                      type: string
                    type: array
                  ecs_mapping:
                    $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
                  id:
                    type: string
                  platform:
                    type: string
                  query:
                    type: string
                  saved_query_id:
                    type: string
                  timeout:
                    type: integer
                  version:
                    type: string
              type: array
            type:
              description: The action type.
              type: string
            user_id:
              description: The user who created the action.
              type: string
          required:
          - action_id
      required:
      - data
    Security_Osquery_API_ECSMapping:
      additionalProperties:
        $ref: '#/components/schemas/Security_Osquery_API_ECSMappingItem'
      description: Map osquery results columns or static values to Elastic Common Schema (ECS) fields
      example:
        host.uptime:
          field: total_seconds
      type: object
    Security_Osquery_API_ECSMappingArrayItem:
      description: ECS mapping item in saved-object storage format (key-value pair).
      type: object
      properties:
        key:
          description: The ECS field name.
          type: string
        value:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMappingItem'
    Security_Osquery_API_GetUnifiedHistoryResponse:
      example:
        data:
        - actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
          agentCount: 5
          errorCount: 0
          id: 3c42c847-eb30-4452-80e0-728584042334
          queryName: uptime_query
          queryText: select * from uptime;
          source: Live
          sourceType: live
          successCount: 5
          timestamp: '2024-07-26T09:59:32.220Z'
          totalRows: 42
          userId: elastic
        - agentCount: 10
          errorCount: 1
          executionCount: 3
          id: pack_my_pack_uptime_3
          packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
          packName: My Pack
          plannedTime: '2024-07-26T09:00:00.000Z'
          queryName: uptime
          queryText: select * from uptime;
          scheduleId: pack_my_pack_uptime
          source: Scheduled
          sourceType: scheduled
          successCount: 9
          timestamp: '2024-07-26T09:00:00.000Z'
          totalRows: 100
        hasMore: true
        nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
      type: object
      properties:
        data:
          description: The list of unified history rows for the current page.
          items:
            $ref: '#/components/schemas/Security_Osquery_API_UnifiedHistoryRow'
          type: array
        hasMore:
          description: Whether there are more results beyond the current page.
          type: boolean
        nextPage:
          description: A base64-encoded cursor to fetch the next page. Absent when there are no more results.
          type: string
      required:
      - data
      - hasMore
    Security_Osquery_API_Enabled:
      description: Enables the pack.
      example: true
      type: boolean
    Security_Osquery_API_SortOrUndefined:
      default: createdAt
      description: The field that is used to sort the results.
      example: createdAt
      nullable: true
      type: string
    Security_Osquery_API_GetScheduledQueryResultsResponse:
      description: The response for getting scheduled query results.
      example:
        data:
          edges:
          - _id: row-001
            fields:
              host.uptime:
              - '12345'
          - _id: row-002
            fields:
              host.uptime:
              - '67890'
          total: 2
      type: object
      properties:
        data:
          description: The query results data wrapper.
          type: object
          properties:
            edges:
              description: The paginated list of query result rows.
              items:
                type: object
              type: array
            inspect:
              description: Debug/inspection data for the search query.
              type: object
            total:
              description: The total number of result rows.
              type: integer
    Security_Osquery_API_GetScheduledActionResultsResponse:
      example:
        aggregations:
          failed: 1
          pending: 0
          successful: 9
          totalResponded: 10
          totalRowCount: 42
        currentPage: 0
        edges:
        - _id: result-001
          fields:
            agent_id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
            rows_count: 5
            status: success
        metadata:
          executionCount: 3
          packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
          packName: My Pack
          queryName: uptime
          queryText: select * from uptime;
          scheduleId: pack_my_pack_uptime
          timestamp: '2024-07-26T09:00:00.000Z'
        pageSize: 20
        total: 10
        totalPages: 1
      type: object
      properties:
        aggregations:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduledActionResultsAggregations'
        currentPage:
          description: The current page number (zero-based).
          type: integer
        edges:
          description: The paginated list of per-agent action results.
          items:
            type: object
          type: array
        inspect:
          description: Debug/inspection data for the search query.
          type: object
        metadata:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduledExecutionMetadata'
        pageSize:
          description: The number of results per page.
          type: integer
        total:
          description: The total number of action results.
          type: integer
        totalPages:
          description: The total number of pages.
          type: integer
    Security_Osquery_API_PageSizeOrUndefined:
      description: The number of results to return per page. The default is 20.
      example: 20
      nullable: true
      type: integer
    Security_Osquery_API_Snapshot:
      description: Indicates whether the query is a snapshot.
      example: true
      type: boolean
    Security_Osquery_API_UpdatePacksResponse:
      description: The response for updating a pack.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: My pack
          enabled: true
          name: updated_my_pack_name
          policy_ids:
          - my_policy_id
          queries:
            ports:
              ecs_mapping:
                client.port:
                  field: port
              interval: 60
              query: SELECT * FROM listening_ports;
              removed: false
              snapshot: true
              timeout: 120
          saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
          shards:
            47638692-7c4c-4053-aa3e-7186f28df349: 35
            5e267651-fe50-443e-8d3f-3bbc9171b618: 58
          updated_at: '2025-02-26T13:40:16.297Z'
          updated_by: elastic
          version: 1
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              format: date-time
              type: string
            created_by:
              nullable: true
              type: string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
            saved_object_id:
              description: The saved object ID of the pack.
              type: string
            shards:
              $ref: '#/components/schemas/Security_Osquery_API_Shards'
            updated_at:
              format: date-time
              type: string
            updated_by:
              nullable: true
              type: string
            updated_by_profile_uid:
              type: string
            version:
              description: The pack version number.
              type: integer
    Security_Osquery_API_SavedQueryId:
      description: The ID of a saved query.
      example: 3c42c847-eb30-4452-80e0-728584042334
      type: string
    Security_Osquery_API_QueryId:
      description: The ID of the query.
      example: 3c42c847-eb30-4452-80e0-728584042334
      type: string
    Security_Osquery_API_GetLiveQueryResultsResponse:
      description: The response for getting live query results.
      example:
        data:
          edges:
          - _id: doc1
            _source: {}
          - _id: doc2
            _source: {}
          total: 2
      type: object
      properties:
        data:
          type: object
          properties:
            edges:
              description: The result rows from the query execution.
              items:
                type: object
                properties:
                  _id:
                    type: string
                  _source:
                    description: The Elasticsearch document source containing query results.
                    type: object
              type: array
            total:
              description: The total number of result rows.
              type: integer
    Security_Osquery_API_PackName:
      description: The pack name.
      example: my_pack
      type: string
    Security_Osquery_API_Removed:
      description: Indicates whether the query is removed.
      example: false
      type: boolean
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"