Create a pack

Base URL: https://{kibana_url}

POST /api/osquery/packs
POST /s/{space_id}/api/osquery/packs

Auth

Create a query pack.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

description string: The pack description.
enabled boolean: Enables the pack.
name string: The pack name.
policy_ids string[]: A list of agents policy IDs.
queries map string to object: An object of queries.
shards map string to number: An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

Response

application/json

Response Type: object

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/osquery/packs
{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id",
    "fleet-server-policy"
  ],
  "queries": {
    "my_query": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        },
        "tags": {
          "value": [
            "tag1",
            "tag2"
          ]
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  },
  "shards": {
    "fleet-server-policy": 58,
    "my_policy_id": 35
  }
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/osquery/packs" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id",
      "fleet-server-policy"
    ],
    "queries": {
      "my_query": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          },
          "tags": {
            "value": [
              "tag1",
              "tag2"
            ]
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "timeout": 120
      }
    },
    "shards": {
      "fleet-server-policy": 58,
      "my_policy_id": 35
    }
  }'

Generated from the API spec

Response

{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "queries": {
      "ports": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": [
      {
        "key": "47638692-7c4c-4053-aa3e-7186f28df349",
        "value": 35
      },
      {
        "key": "5e267651-fe50-443e-8d3f-3bbc9171b618",
        "value": 58
      }
    ],
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic"
  }
}

Generated from the API spec

Path parameters

Request body { }

Response

Request body