mirror of
https://github.com/elastic/kibana.git
synced 2025-06-28 11:05:39 -04:00
86a31db057
Contributes to https://github.com/elastic/security-docs/issues/4536 by documenting the new **Timeout** setting and `timeout` API parameter in Osquery docs. --------- Co-authored-by: nastasha.solomon <nastasha.solomon@elastic.co> Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
86 lines
2.4 KiB
Text
86 lines
2.4 KiB
Text
[[osquery-manager-saved-queries-api-create]]
|
|
=== Create saved query API
|
|
++++
|
|
<titleabbrev>Create saved query</titleabbrev>
|
|
++++
|
|
|
|
experimental[] Create saved queries.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-create-request]]
|
|
==== Request
|
|
|
|
`POST <kibana host>:<port>/api/osquery/saved_queries`
|
|
|
|
`POST <kibana host>:<port>/s/<space_id>/api/osquery/saved_queries`
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-create-path-params]]
|
|
==== Path parameters
|
|
|
|
`space_id`::
|
|
(Optional, string) The space identifier. When `space_id` is not provided in the URL, the default space is used.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-create-body-params]]
|
|
==== Request body
|
|
|
|
`id`:: (Required, string) The saved query name.
|
|
|
|
`description`:: (Optional, string) The saved query description.
|
|
|
|
`platform`:: (Optional, string) Restricts the query to a specified platform. The default is 'all' platforms. To specify multiple platforms, use commas. For example, 'linux,darwin'.
|
|
|
|
`query`:: (Required, string) The SQL query you want to run.
|
|
|
|
`version`:: (Optional, string) Uses the Osquery versions greater than or equal to the specified version string.
|
|
|
|
`interval`:: (Optional, string) An interval, in seconds, on which to run the query.
|
|
|
|
`ecs_mapping`:: (Optional, object) Maps Osquery results columns or static values to ECS fields.
|
|
|
|
`timeout`:: (Optional, number) A timeout period, in seconds, after which the query will stop running. Overwriting the default timeout allows you to support queries that require more time to complete. The default and minimum supported value is `60`. The maximum supported value is `900`.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-create-request-codes]]
|
|
==== Response code
|
|
|
|
`200`::
|
|
Indicates a successful call.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-create-example]]
|
|
==== Examples
|
|
|
|
Create a saved query:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
$ curl -X POST api/osquery/saved_queries \
|
|
{
|
|
"id": "saved_query_id",
|
|
"description": "Saved query description",
|
|
"query": "select * from uptime;",
|
|
"interval": "60",
|
|
"timeout": 120,
|
|
"version": "2.8.0",
|
|
"platform": "linux,darwin",
|
|
"ecs_mapping": {
|
|
"host.uptime": {
|
|
"field": "total_seconds"
|
|
}
|
|
}
|
|
}
|
|
|
|
--------------------------------------------------
|
|
// KIBANA
|
|
|
|
|
|
The API returns the saved query object:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
{
|
|
"data": {...}
|
|
}
|
|
--------------------------------------------------
|