mirror of
https://github.com/elastic/kibana.git
synced 2025-06-28 19:13:14 -04:00
d0f095f2ec
# Backport This will backport the following commits from `main` to `8.x`: - [[DOCS ]Direct users to new API reference site (#195909)](https://github.com/elastic/kibana/pull/195909) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"natasha-moore-elastic","email":"137783811+natasha-moore-elastic@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-10-15T15:29:05Z","message":"[DOCS ]Direct users to new API reference site (#195909)\n\n## Summary\r\n\r\nContributes to\r\nhttps://github.com/elastic/security-docs-internal/issues/48.\r\n\r\nAdd callouts to the asciidoc Osquery API docs to direct users to the new\r\nAPI reference site, in preparation for retiring the asciidoc API docs.\r\n\r\nNOTE: The api-kibana variable is defined in version-specific files. In\r\n[8.15.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)),\r\nthe variable points to the [v8\r\nbranch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API\r\nreference, which currently doesn't include Security API docs. The v8\r\nbranch is derived from the \"current\" Kibana branch, which is currently\r\n8.15. This likely means that we can only backport the callouts to 8.16\r\nonce 8.16 becomes the \"current\" docs version.\r\n\r\nPreview: [Osquery manager\r\nAPI](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html)\r\nand all its child pages","sha":"f0f17756324836e00ae0440ed1ba34c90490e843","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Docs","release_note:skip","v9.0.0","docs","Feature:Osquery","APIDocs","v8.16.0","backport:version"],"title":"[DOCS ]Direct users to new API reference site","number":195909,"url":"https://github.com/elastic/kibana/pull/195909","mergeCommit":{"message":"[DOCS ]Direct users to new API reference site (#195909)\n\n## Summary\r\n\r\nContributes to\r\nhttps://github.com/elastic/security-docs-internal/issues/48.\r\n\r\nAdd callouts to the asciidoc Osquery API docs to direct users to the new\r\nAPI reference site, in preparation for retiring the asciidoc API docs.\r\n\r\nNOTE: The api-kibana variable is defined in version-specific files. In\r\n[8.15.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)),\r\nthe variable points to the [v8\r\nbranch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API\r\nreference, which currently doesn't include Security API docs. The v8\r\nbranch is derived from the \"current\" Kibana branch, which is currently\r\n8.15. This likely means that we can only backport the callouts to 8.16\r\nonce 8.16 becomes the \"current\" docs version.\r\n\r\nPreview: [Osquery manager\r\nAPI](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html)\r\nand all its child pages","sha":"f0f17756324836e00ae0440ed1ba34c90490e843"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/195909","number":195909,"mergeCommit":{"message":"[DOCS ]Direct users to new API reference site (#195909)\n\n## Summary\r\n\r\nContributes to\r\nhttps://github.com/elastic/security-docs-internal/issues/48.\r\n\r\nAdd callouts to the asciidoc Osquery API docs to direct users to the new\r\nAPI reference site, in preparation for retiring the asciidoc API docs.\r\n\r\nNOTE: The api-kibana variable is defined in version-specific files. In\r\n[8.15.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)),\r\nthe variable points to the [v8\r\nbranch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API\r\nreference, which currently doesn't include Security API docs. The v8\r\nbranch is derived from the \"current\" Kibana branch, which is currently\r\n8.15. This likely means that we can only backport the callouts to 8.16\r\nonce 8.16 becomes the \"current\" docs version.\r\n\r\nPreview: [Osquery manager\r\nAPI](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html)\r\nand all its child pages","sha":"f0f17756324836e00ae0440ed1ba34c90490e843"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>
47 lines
2.5 KiB
Text
47 lines
2.5 KiB
Text
[[osquery-manager-api]]
|
|
== Osquery manager API
|
|
|
|
.New API Reference
|
|
[sidebar]
|
|
--
|
|
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-osquery-api[Osquery APIs].
|
|
--
|
|
|
|
experimental[] Run live queries, manage packs and saved queries
|
|
|
|
Use the osquery manager APIs for managing packs and saved queries.
|
|
|
|
The following osquery manager APIs are available:
|
|
|
|
* Live queries
|
|
** <<osquery-manager-live-queries-api-get-all, Get all live queries API>> to retrieve a list of live queries
|
|
** <<osquery-manager-live-queries-api-get, Get live query API>> to retrieve a single live query
|
|
** <<osquery-manager-live-queries-api-create, Create live query API>> to create a live query
|
|
** <<osquery-manager-live-queries-api-get-results, Get live query results API>> to retrieve the results of a single live query
|
|
* Packs
|
|
** <<osquery-manager-packs-api-get-all, Get all packs API>> to retrieve a list of packs
|
|
** <<osquery-manager-packs-api-get, Get pack API>> to retrieve a pack
|
|
** <<osquery-manager-packs-api-create, Create pack API>> to create a pack
|
|
** <<osquery-manager-packs-api-update, Update pack API>> to partially update an existing pack
|
|
** <<osquery-manager-packs-api-delete, Delete pack API>> to delete a pack
|
|
* Saved queries
|
|
** <<osquery-manager-saved-queries-api-get-all, Get all saved queries API>> to retrieve a list of saved queries
|
|
** <<osquery-manager-saved-queries-api-get, Get saved query API>> to retrieve a saved query
|
|
** <<osquery-manager-saved-queries-api-create, Create saved query API>> to create a saved query
|
|
** <<osquery-manager-saved-queries-api-update, Update saved query API>> to partially update an existing saved query
|
|
** <<osquery-manager-saved-queries-api-delete, Delete saved query API>> to delete a saved query
|
|
|
|
include::osquery-manager/live-queries/get.asciidoc[]
|
|
include::osquery-manager/live-queries/get-all.asciidoc[]
|
|
include::osquery-manager/live-queries/get-results.asciidoc[]
|
|
include::osquery-manager/live-queries/create.asciidoc[]
|
|
include::osquery-manager/packs/get.asciidoc[]
|
|
include::osquery-manager/packs/get-all.asciidoc[]
|
|
include::osquery-manager/packs/create.asciidoc[]
|
|
include::osquery-manager/packs/update.asciidoc[]
|
|
include::osquery-manager/packs/delete.asciidoc[]
|
|
include::osquery-manager/saved-queries/get.asciidoc[]
|
|
include::osquery-manager/saved-queries/get-all.asciidoc[]
|
|
include::osquery-manager/saved-queries/create.asciidoc[]
|
|
include::osquery-manager/saved-queries/update.asciidoc[]
|
|
include::osquery-manager/saved-queries/delete.asciidoc[]
|