mirror of
https://github.com/elastic/kibana.git
synced 2025-06-28 11:05:39 -04:00
88 lines
1.7 KiB
Text
88 lines
1.7 KiB
Text
[[osquery-manager-packs-api-create]]
|
|
=== Create pack API
|
|
++++
|
|
<titleabbrev>Create pack</titleabbrev>
|
|
++++
|
|
|
|
experimental[] Create packs.
|
|
|
|
|
|
[[osquery-manager-packs-api-create-request]]
|
|
==== Request
|
|
|
|
`POST <kibana host>:<port>/api/osquery/packs`
|
|
|
|
`POST <kibana host>:<port>/s/<space_id>/api/osquery/packs`
|
|
|
|
|
|
[[osquery-manager-packs-api-create-path-params]]
|
|
==== Path parameters
|
|
|
|
`space_id`::
|
|
(Optional, string) The space identifier. When `space_id` is not provided in the URL, the default space is used.
|
|
|
|
|
|
[[osquery-manager-packs-api-create-body-params]]
|
|
==== Request body
|
|
|
|
`name`:: (Required, string) The pack name.
|
|
|
|
`description`:: (Optional, string) The pack description.
|
|
|
|
`enabled`:: (Optional, boolean) Enables the pack.
|
|
|
|
`policy_ids`:: (Optional, array) A list of agents policy IDs.
|
|
|
|
`queries`:: (Required, object) An object of queries.
|
|
|
|
|
|
[[osquery-manager-packs-api-create-request-codes]]
|
|
==== Response code
|
|
|
|
`200`::
|
|
Indicates a successful call.
|
|
|
|
|
|
[[osquery-manager-packs-api-create-example]]
|
|
==== Examples
|
|
|
|
Create a pack:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
$ curl -X POST api/osquery/packs \
|
|
{
|
|
"name": "my_pack",
|
|
"description": "My pack",
|
|
"enabled": true,
|
|
"policy_ids": [
|
|
"my_policy_id"
|
|
],
|
|
"queries": {
|
|
"my_query": {
|
|
"query": "SELECT * FROM listening_ports;",
|
|
"interval": 60,
|
|
"ecs_mapping": {
|
|
"client.port": {
|
|
"field": "port"
|
|
},
|
|
"tags": {
|
|
"value": ["tag1", "tag2"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
--------------------------------------------------
|
|
// KIBANA
|
|
|
|
|
|
The API returns the pack object:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
{
|
|
"data": {...}
|
|
}
|
|
--------------------------------------------------
|