mirror of
https://github.com/elastic/kibana.git
synced 2025-06-28 19:13:14 -04:00
f0f1775632
## Summary Contributes to https://github.com/elastic/security-docs-internal/issues/48. Add callouts to the asciidoc Osquery API docs to direct users to the new API reference site, in preparation for retiring the asciidoc API docs. NOTE: The api-kibana variable is defined in version-specific files. In [8.15.asciidoc](873ec2c47f/shared/versions/stack/8.15.asciidoc (L74)) and [8.x.asciidoc](873ec2c47f/shared/versions/stack/8.x.asciidoc (L75)), the variable points to the [v8 branch](https://www.elastic.co/docs/api/doc/kibana/v8) of the API reference, which currently doesn't include Security API docs. The v8 branch is derived from the "current" Kibana branch, which is currently 8.15. This likely means that we can only backport the callouts to 8.16 once 8.16 becomes the "current" docs version. Preview: [Osquery manager API](https://kibana_bk_195909.docs-preview.app.elstc.co/guide/en/kibana/master/osquery-manager-api.html) and all its child pages
84 lines
2.2 KiB
Text
84 lines
2.2 KiB
Text
[[osquery-manager-saved-queries-api-update]]
|
|
=== Update saved query API
|
|
++++
|
|
<titleabbrev>Update saved query</titleabbrev>
|
|
++++
|
|
|
|
.New API Reference
|
|
[sidebar]
|
|
--
|
|
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-osquery-api[Osquery APIs].
|
|
--
|
|
|
|
experimental[] Update saved queries.
|
|
|
|
WARNING: You are unable to update a prebuilt saved query (`prebuilt = true`).
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-update-request]]
|
|
==== Request
|
|
|
|
`PUT <kibana host>:<port>/api/osquery/saved_queries/<id>`
|
|
|
|
`PUT <kibana host>:<port>/s/<space_id>/api/osquery/saved_queries/<id>`
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-update-path-params]]
|
|
==== Path parameters
|
|
|
|
`space_id`::
|
|
(Optional, string) The space identifier. When `space_id` is not provided in the URL, the default space is used.
|
|
|
|
`id`::
|
|
(Required, string) The ID of the saved query you want to update.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-update-body-params]]
|
|
==== Request body
|
|
|
|
`id`:: (Required, string) The saved query name.
|
|
|
|
`description`:: (Optional, string) The saved query description.
|
|
|
|
`platform`:: (Optional, string) Restricts the query to a specified platform. The default is 'all' platforms. To specify multiple platforms, use commas. For example, 'linux,darwin'.
|
|
|
|
`query`:: (Required, string) The SQL query you want to run.
|
|
|
|
`version`:: (Optional, string) Runs on Osquery versions greater than or equal to the specified version string.
|
|
|
|
`interval`:: (Optional, integer) The interval, in seconds, to run the query.
|
|
|
|
`ecs_mapping`:: (Optional, object) Maps Osquery result columns or static values to ECS fields.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-update-request-codes]]
|
|
==== Response code
|
|
|
|
`200`::
|
|
Indicates a successful call.
|
|
|
|
|
|
[[osquery-manager-saved-queries-api-update-example]]
|
|
==== Examples
|
|
|
|
Update a name of the <my_saved query> saved query:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
$ curl -X PUT api/osquery/saved_queries/<id> \
|
|
{
|
|
"id": "updated_my_saved_query_name",
|
|
}
|
|
|
|
--------------------------------------------------
|
|
// KIBANA
|
|
|
|
|
|
The API returns the saved query saved object:
|
|
|
|
[source,sh]
|
|
--------------------------------------------------
|
|
{
|
|
"data": {...}
|
|
}
|
|
--------------------------------------------------
|