mirror of
https://github.com/elastic/kibana.git
synced 2025-06-30 03:53:20 -04:00
d0f095f2ec
# Backport This will backport the following commits from `main` to `8.x`: - [[DOCS ]Direct users to new API reference site (#195909)](https://github.com/elastic/kibana/pull/195909) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"natasha-moore-elastic","email":"137783811+natasha-moore-elastic@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-10-15T15:29:05Z","message":"[DOCS ]Direct users to new API reference site (#195909)\n\n## Summary\r\n\r\nContributes to\r\nhttps://github.com/elastic/security-docs-internal/issues/48.\r\n\r\nAdd callouts to the asciidoc Osquery API docs to direct users to the new\r\nAPI reference site, in preparation for retiring the asciidoc API docs.\r\n\r\nNOTE: The api-kibana variable is defined in version-specific files. In\r\n[8.15.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)),\r\nthe variable points to the [v8\r\nbranch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API\r\nreference, which currently doesn't include Security API docs. The v8\r\nbranch is derived from the \"current\" Kibana branch, which is currently\r\n8.15. This likely means that we can only backport the callouts to 8.16\r\nonce 8.16 becomes the \"current\" docs version.\r\n\r\nPreview: [Osquery manager\r\nAPI](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html)\r\nand all its child pages","sha":"f0f17756324836e00ae0440ed1ba34c90490e843","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Docs","release_note:skip","v9.0.0","docs","Feature:Osquery","APIDocs","v8.16.0","backport:version"],"title":"[DOCS ]Direct users to new API reference site","number":195909,"url":"https://github.com/elastic/kibana/pull/195909","mergeCommit":{"message":"[DOCS ]Direct users to new API reference site (#195909)\n\n## Summary\r\n\r\nContributes to\r\nhttps://github.com/elastic/security-docs-internal/issues/48.\r\n\r\nAdd callouts to the asciidoc Osquery API docs to direct users to the new\r\nAPI reference site, in preparation for retiring the asciidoc API docs.\r\n\r\nNOTE: The api-kibana variable is defined in version-specific files. In\r\n[8.15.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)),\r\nthe variable points to the [v8\r\nbranch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API\r\nreference, which currently doesn't include Security API docs. The v8\r\nbranch is derived from the \"current\" Kibana branch, which is currently\r\n8.15. This likely means that we can only backport the callouts to 8.16\r\nonce 8.16 becomes the \"current\" docs version.\r\n\r\nPreview: [Osquery manager\r\nAPI](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html)\r\nand all its child pages","sha":"f0f17756324836e00ae0440ed1ba34c90490e843"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/195909","number":195909,"mergeCommit":{"message":"[DOCS ]Direct users to new API reference site (#195909)\n\n## Summary\r\n\r\nContributes to\r\nhttps://github.com/elastic/security-docs-internal/issues/48.\r\n\r\nAdd callouts to the asciidoc Osquery API docs to direct users to the new\r\nAPI reference site, in preparation for retiring the asciidoc API docs.\r\n\r\nNOTE: The api-kibana variable is defined in version-specific files. In\r\n[8.15.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)),\r\nthe variable points to the [v8\r\nbranch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API\r\nreference, which currently doesn't include Security API docs. The v8\r\nbranch is derived from the \"current\" Kibana branch, which is currently\r\n8.15. This likely means that we can only backport the callouts to 8.16\r\nonce 8.16 becomes the \"current\" docs version.\r\n\r\nPreview: [Osquery manager\r\nAPI](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html)\r\nand all its child pages","sha":"f0f17756324836e00ae0440ed1ba34c90490e843"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>
105 lines
2.2 KiB
Text
105 lines
2.2 KiB
Text
[[osquery-manager-packs-api-create]]
|
||
=== Create pack API
|
||
++++
|
||
<titleabbrev>Create pack</titleabbrev>
|
||
++++
|
||
|
||
.New API Reference
|
||
[sidebar]
|
||
--
|
||
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-osquery-api[Osquery APIs].
|
||
--
|
||
|
||
experimental[] Create packs.
|
||
|
||
|
||
[[osquery-manager-packs-api-create-request]]
|
||
==== Request
|
||
|
||
`POST <kibana host>:<port>/api/osquery/packs`
|
||
|
||
`POST <kibana host>:<port>/s/<space_id>/api/osquery/packs`
|
||
|
||
|
||
[[osquery-manager-packs-api-create-path-params]]
|
||
==== Path parameters
|
||
|
||
`space_id`::
|
||
(Optional, string) The space identifier. When `space_id` is not provided in the URL, the default space is used.
|
||
|
||
|
||
[[osquery-manager-packs-api-create-body-params]]
|
||
==== Request body
|
||
|
||
`name`:: (Required, string) The pack name.
|
||
|
||
`description`:: (Optional, string) The pack description.
|
||
|
||
`enabled`:: (Optional, boolean) Enables the pack.
|
||
|
||
`policy_ids`:: (Optional, array) A list of agents policy IDs.
|
||
|
||
`shards`:: (Optional, object) An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
|
||
|
||
`queries`:: (Required, object) An object of queries.
|
||
|
||
|
||
[[osquery-manager-packs-api-create-request-codes]]
|
||
==== Response code
|
||
|
||
`200`::
|
||
Indicates a successful call.
|
||
|
||
|
||
[[osquery-manager-packs-api-create-example]]
|
||
==== Examples
|
||
|
||
Create a pack:
|
||
|
||
[source,sh]
|
||
--------------------------------------------------
|
||
$ curl -X POST api/osquery/packs \
|
||
{
|
||
"name": "my_pack",
|
||
"description": "My pack",
|
||
"enabled": true,
|
||
"policy_ids": [
|
||
"my_policy_id",
|
||
"fleet-server-policy"
|
||
],
|
||
"shards": {
|
||
"my_policy_id": 35,
|
||
"fleet-server-policy": 58
|
||
},
|
||
"queries": {
|
||
"my_query": {
|
||
"query": "SELECT * FROM listening_ports;",
|
||
"interval": 60,
|
||
"timeout": 120,
|
||
"ecs_mapping": {
|
||
"client.port": {
|
||
"field": "port"
|
||
},
|
||
"tags": {
|
||
"value": [
|
||
"tag1",
|
||
"tag2"
|
||
]
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
--------------------------------------------------
|
||
// KIBANA
|
||
|
||
|
||
The API returns the pack object:
|
||
|
||
[source,sh]
|
||
--------------------------------------------------
|
||
{
|
||
"data": {...}
|
||
}
|
||
--------------------------------------------------
|