mirror of
https://github.com/elastic/kibana.git
synced 2025-04-25 18:27:59 -04:00
f0f1775632
## Summary Contributes to https://github.com/elastic/security-docs-internal/issues/48. Add callouts to the asciidoc Osquery API docs to direct users to the new API reference site, in preparation for retiring the asciidoc API docs. NOTE: The api-kibana variable is defined in version-specific files. In [8.15.asciidoc](873ec2c47f/shared/versions/stack/8.15.asciidoc (L74)) and [8.x.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)), the variable points to the [v8 branch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API reference, which currently doesn't include Security API docs. The v8 branch is derived from the "current" Kibana branch, which is currently 8.15. This likely means that we can only backport the callouts to 8.16 once 8.16 becomes the "current" docs version. Preview: [Osquery manager API](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html) and all its child pages
104 lines
2.7 KiB
Text
104 lines
2.7 KiB
Text
[[osquery-manager-live-queries-api-get-all]]
|
|
=== Get live queries API
|
|
++++
|
|
<titleabbrev>Get live queries</titleabbrev>
|
|
++++
|
|
|
|
.New API Reference
|
|
[sidebar]
|
|
--
|
|
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-osquery-api[Osquery APIs].
|
|
--
|
|
|
|
experimental[] Get live queries.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-all-request]]
|
|
==== Request
|
|
|
|
`GET <kibana host>:<port>/api/osquery/live_queries`
|
|
|
|
`GET <kibana host>:<port>/s/<space_id>/api/osquery/live_queries`
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-all-params]]
|
|
==== Path parameters
|
|
|
|
`space_id`::
|
|
(Optional, string) An identifier for the space. When `space_id` is not provided in the URL, the default space is used.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-all-query-params]]
|
|
==== Query parameters
|
|
|
|
`page`::
|
|
(Optional, integer) The page number to return. The default is `1`.
|
|
|
|
`pageSize`::
|
|
(Optional, integer) The number of rules to return per page. The default is `20`.
|
|
|
|
`sort`::
|
|
(Optional, string) The field that is used to sort the results. Options include `createdAt` or `updatedAt`.
|
|
The default is `createdAt`.
|
|
+
|
|
NOTE: Even though the JSON case object uses `created_at` and `updated_at`
|
|
fields, you must use `createdAt` and `updatedAt` fields in the URL
|
|
query.
|
|
|
|
`sortOrder`::
|
|
(Optional, string) Specified the sort order. Options include `desc` or `asc`.
|
|
The default is `desc`.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-all-codes]]
|
|
==== Response code
|
|
|
|
`200`::
|
|
Indicates a successful call.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-all-example]]
|
|
==== Example
|
|
|
|
Retrieve the last 10 live queries :
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
$ curl -X GET api/osquery/live_queries?page=1&perPage=10
|
|
--------------------------------------------------
|
|
// KIBANA
|
|
|
|
The API returns a JSON object of the retrieved live queries:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
{
|
|
"page": 1,
|
|
"per_page": 10,
|
|
"total": 11,
|
|
"data": [
|
|
{
|
|
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
|
|
"expiration": "2022-07-26T10:04:32.220Z",
|
|
"@timestamp": "2022-07-26T09:59:32.220Z",
|
|
"agents": ["16d7caf5-efd2-4212-9b62-73dafc91fa13"],
|
|
"user_id": "elastic",
|
|
"queries": [
|
|
{
|
|
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
|
|
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
|
|
"query": "select * from uptime;",
|
|
"saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
|
|
"ecs_mapping": {
|
|
"host.uptime": {
|
|
"field": "total_seconds"
|
|
}
|
|
},
|
|
"agents": ["16d7caf5-efd2-4212-9b62-73dafc91fa13"],
|
|
}
|
|
],
|
|
},
|
|
{...}
|
|
]
|
|
}
|
|
--------------------------------------------------
|