mirror of
https://github.com/elastic/kibana.git
synced 2025-04-25 18:27:59 -04:00
f0f1775632
## Summary Contributes to https://github.com/elastic/security-docs-internal/issues/48. Add callouts to the asciidoc Osquery API docs to direct users to the new API reference site, in preparation for retiring the asciidoc API docs. NOTE: The api-kibana variable is defined in version-specific files. In [8.15.asciidoc](873ec2c47f/shared/versions/stack/8.15.asciidoc (L74)) and [8.x.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)), the variable points to the [v8 branch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API reference, which currently doesn't include Security API docs. The v8 branch is derived from the "current" Kibana branch, which is currently 8.15. This likely means that we can only backport the callouts to 8.16 once 8.16 becomes the "current" docs version. Preview: [Osquery manager API](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html) and all its child pages
89 lines
2.4 KiB
Text
89 lines
2.4 KiB
Text
[[osquery-manager-live-queries-api-get]]
|
|
=== Get live query API
|
|
++++
|
|
<titleabbrev>Get live query</titleabbrev>
|
|
++++
|
|
|
|
.New API Reference
|
|
[sidebar]
|
|
--
|
|
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-osquery-api[Osquery APIs].
|
|
--
|
|
|
|
experimental[] Retrieves a single live query by ID.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-request]]
|
|
==== Request
|
|
|
|
`GET <kibana host>:<port>/api/osquery/live_queries/<id>`
|
|
|
|
`GET <kibana host>:<port>/s/<space_id>/api/osquery/live_queries/<id>`
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-params]]
|
|
==== Path parameters
|
|
|
|
`space_id`::
|
|
(Optional, string) The space identifier. When `space_id` is not provided in the URL, the default space is used.
|
|
|
|
`id`::
|
|
(Required, string) The ID of the live query you want to retrieve.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-codes]]
|
|
==== Response code
|
|
|
|
`200`::
|
|
Indicates a successful call.
|
|
|
|
`404`::
|
|
The specified live query and ID doesn't exist.
|
|
|
|
|
|
[[osquery-manager-live-queries-api-get-example]]
|
|
==== Example
|
|
|
|
Retrieve the live query object with the `bbe5b070-0c51-11ed-b0f8-ad31b008e832` ID:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
$ curl -X GET api/osquery/live_queries/bbe5b070-0c51-11ed-b0f8-ad31b008e832
|
|
--------------------------------------------------
|
|
// KIBANA
|
|
|
|
The API returns a live query object:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
{
|
|
"data": {
|
|
"action_id": "3c42c847-eb30-4452-80e0-728584042334",
|
|
"expiration": "2022-07-26T10:04:32.220Z",
|
|
"@timestamp": "2022-07-26T09:59:32.220Z",
|
|
"agents": ["16d7caf5-efd2-4212-9b62-73dafc91fa13"],
|
|
"user_id": "elastic",
|
|
"queries": [
|
|
{
|
|
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
|
|
"id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
|
|
"query": "select * from uptime;",
|
|
"saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
|
|
"ecs_mapping": {
|
|
"host.uptime": {
|
|
"field": "total_seconds"
|
|
}
|
|
},
|
|
"agents": ["16d7caf5-efd2-4212-9b62-73dafc91fa13"],
|
|
"docs": 0, # results count
|
|
"failed": 1, # failed queries
|
|
"pending": 0, # pending agents
|
|
"responded": 1, # total responded agents
|
|
"successful": 0, # successful agents
|
|
"status": "completed" # single query status
|
|
}
|
|
],
|
|
"status": "completed" # global status of the live query (completed, pending)
|
|
}
|
|
}
|
|
--------------------------------------------------
|