Elastic Stack (ELK Stack) Security Osquery API
Run live queries, manage packs and saved queries.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/elk-stack-security-osquery-api-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana Security Osquery API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Run live queries, manage packs and saved queries.
name: Security Osquery API
x-displayName: Security Osquery
paths:
/api/osquery/history:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/history</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.
'
operationId: OsqueryGetUnifiedHistory
parameters:
- description: The number of results to return per page.
in: query
name: pageSize
required: false
schema:
default: 20
description: The number of results to return per page.
maximum: 100
minimum: 1
type: integer
- description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
in: query
name: nextPage
required: false
schema:
description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
type: string
- description: A search string to filter history entries by pack name, query text, or query ID.
in: query
name: kuery
required: false
schema:
description: A search string to filter history entries by pack name, query text, or query ID.
type: string
- description: Comma-separated list of user IDs to filter live query history.
in: query
name: userIds
required: false
schema:
description: Comma-separated list of user IDs to filter live query history.
example: elastic,admin
type: string
- description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
in: query
name: sourceFilters
required: false
schema:
description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
example: live,scheduled
type: string
- description: The start of the time range filter (ISO 8601).
in: query
name: startDate
required: false
schema:
description: The start of the time range filter (ISO 8601).
example: '2024-01-01T00:00:00Z'
type: string
- description: The end of the time range filter (ISO 8601).
in: query
name: endDate
required: false
schema:
description: The end of the time range filter (ISO 8601).
example: '2024-12-31T23:59:59Z'
type: string
responses:
'200':
content:
application/json:
examples:
unifiedHistoryExample:
summary: Example unified history response
value:
data:
- actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agentCount: 5
errorCount: 0
id: 3c42c847-eb30-4452-80e0-728584042334
queryName: uptime_query
queryText: select * from uptime;
source: Live
sourceType: live
successCount: 5
timestamp: '2024-07-26T09:59:32.220Z'
totalRows: 42
userId: elastic
- agentCount: 10
errorCount: 1
executionCount: 3
id: pack_my_pack_uptime_3
packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
packName: My Pack
plannedTime: '2024-07-26T09:00:00.000Z'
queryName: uptime
queryText: select * from uptime;
scheduleId: pack_my_pack_uptime
source: Scheduled
sourceType: scheduled
successCount: 9
timestamp: '2024-07-26T09:00:00.000Z'
totalRows: 100
hasMore: true
nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
schema:
$ref: '#/components/schemas/Security_Osquery_API_GetUnifiedHistoryResponse'
description: Indicates a successful call.
summary: Get unified query history
tags:
- Security Osquery API
x-state: Generally available; Added in 9.4.0
x-metaTags:
- content: Kibana
name: product_name
/api/osquery/live_queries:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of all live queries.'
operationId: OsqueryFindLiveQueries
parameters:
- description: A KQL search string to filter live queries.
in: query
name: kuery
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
- description: The page number to return.
in: query
name: page
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- description: The number of results to return per page.
in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- description: The field to sort results by.
in: query
name: sort
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- description: The sort order.
in: query
name: sortOrder
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
content:
application/json:
examples:
liveQueriesList:
summary: A list of recent live queries
value:
data:
items:
- _source:
'@timestamp': '2023-10-31T00:00:00Z'
action_id: 3c42c847-eb30-4452-80e0-728584042334
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
expiration: '2023-10-31T00:00:00Z'
queries:
- action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
ecs_mapping:
host.uptime:
field: total_seconds
id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
query: select * from uptime;
saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
user_id: elastic
total: 1
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryResponse'
description: Indicates a successful call.
summary: Get live queries
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create and run a live query.'
operationId: OsqueryCreateLiveQuery
requestBody:
content:
application/json:
examples:
singleQueryAllAgents:
summary: Run a single query on all agents
value:
agent_all: true
ecs_mapping:
host.uptime:
field: total_seconds
query: select * from uptime;
targetedQuery:
summary: Run a query against specific agents
value:
agent_ids:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
query: select * from processes;
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody'
required: true
responses:
'200':
content:
application/json:
examples:
liveQueryCreated:
summary: Live query created
value:
data:
'@timestamp': '2022-07-26T09:59:32.220Z'
action_id: 3c42c847-eb30-4452-80e0-728584042334
agent_all: true
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
expiration: '2022-07-26T10:04:32.220Z'
input_type: osquery
queries:
- action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
query: select * from uptime;
timeout: 120
type: INPUT_ACTION
user_id: elastic
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse'
description: Indicates a successful call.
summary: Create a live query
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
/api/osquery/live_queries/{id}:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the details of a live query using the query ID.'
operationId: OsqueryGetLiveQueryDetails
parameters:
- description: The ID of the live query.
in: path
name: id
required: true
schema:
description: The ID of the live query result you want to retrieve.
example: 3c42c847-eb30-4452-80e0-728584042334
type: string
responses:
'200':
content:
application/json:
examples:
liveQueryDetails:
summary: Live query details with execution status
value:
data:
'@timestamp': '2022-07-26T09:59:32.220Z'
action_id: 3c42c847-eb30-4452-80e0-728584042334
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
expiration: '2022-07-26T10:04:32.220Z'
queries:
- action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agents:
- 16d7caf5-efd2-4212-9b62-73dafc91fa13
docs: 1
failed: 0
id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
pending: 0
query: select * from uptime;
responded: 1
status: completed
successful: 1
status: completed
user_id: elastic
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse'
description: Indicates a successful call.
summary: Get live query details
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
/api/osquery/live_queries/{id}/results/{actionId}:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the results of a live query using the query action ID.'
operationId: OsqueryGetLiveQueryResults
parameters:
- description: The ID of the live query.
in: path
name: id
required: true
schema:
description: The ID of the live query result you want to retrieve.
example: 3c42c847-eb30-4452-80e0-728584042334
type: string
- description: The ID of the query action.
in: path
name: actionId
required: true
schema:
description: The ID of the query action that generated the live query results.
example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
type: string
- description: A KQL search string to filter results.
in: query
name: kuery
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
- description: The page number to return.
in: query
name: page
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- description: The number of results to return per page.
in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- description: The field to sort results by.
in: query
name: sort
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- description: The sort order.
in: query
name: sortOrder
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
content:
application/json:
examples:
liveQueryResults:
summary: Result rows from a live query execution
value:
data:
edges:
- _id: doc1
_source:
action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agent:
id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
osquery:
total_seconds: '12345'
- _id: doc2
_source:
action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
agent:
id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
osquery:
total_seconds: '67890'
total: 2
schema:
$ref: '#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse'
description: Indicates a successful call.
summary: Get live query results
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
/api/osquery/live_queries/{id}/results/{actionId}/_export:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}/_export</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.
'
operationId: OsqueryExportLiveQueryResults
parameters:
- description: The ID of the live query (parent action ID).
in: path
name: id
required: true
schema:
description: The ID of the live query.
example: 3c42c847-eb30-4452-80e0-728584042334
type: string
- description: The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.
in: path
name: actionId
required: true
schema:
description: The ID of the query action.
example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
type: string
- description: The output format of the exported file.
in: query
name: format
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_ExportFormat'
requestBody:
content:
application/json:
examples:
filteredExport:
summary: Export only rows matching a KQL filter
value:
kuery: 'user.name: "root"'
schema:
$ref: '#/components/schemas/Security_Osquery_API_ExportRequestBody'
required: false
responses:
'200':
content:
application/json:
examples:
jsonExport:
summary: JSON export with metadata and results
value:
_meta:
action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
exported_by: elastic
format: json
query: SELECT * FROM users;
timestamp: '2026-04-30T09:12:00.000Z'
total_results: 2
results:
- '@timestamp': '2026-04-30T09:11:58.321Z'
agent:
id: 980a6b73-0b03-4d1e-8915-67c202e4a980
name: prod-host-1
user:
id: '1000'
name: ubuntu
schema:
$ref: '#/components/schemas/Security_Osquery_API_ExportJsonResponse'
description: 'A JSON object with `_meta` (export metadata) and `results` (all result rows). Rows are held in memory before writing; prefer `ndjson` for large exports.
'
application/ndjson:
examples:
ndjsonExport:
summary: NDJSON export with a leading metadata line
value: '{"_meta":{"action_id":"609c4c66-ba3d-43fa-afdd-53e244577aa0","query":"SELECT * FROM users;","timestamp":"2026-04-30T09:12:00.000Z","exported_by":"elastic","format":"ndjson","total_results":2}}
{"@timestamp":"2026-04-30T09:11:58.321Z","agent":{"id":"980a6b73-0b03-4d1e-8915-67c202e4a980","name":"prod-host-1"},"user":{"id":"1000","name":"ubuntu"}}
{"@timestamp":"2026-04-30T09:11:58.456Z","agent":{"id":"980a6b73-0b03-4d1e-8915-67c202e4a980","name":"prod-host-1"},"user":{"id":"0","name":"root"}}
'
schema:
description: 'Newline-delimited JSON stream. The first line is a metadata object; each subsequent line is a result row.
'
format: binary
type: string
text/csv:
examples:
csvExport:
summary: CSV export with a header row
value: 'agent.name,agent.id,user.id,user.name
prod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,1000,ubuntu
prod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,0,root
'
schema:
description: 'CSV file with a header row derived from the ECS mapping of the originating query (when available). No metadata block is included in CSV output.
'
format: binary
type: string
description: 'A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.
'
headers:
Content-Disposition:
description: Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson"`.
schema:
example: attachment; filename="osquery-results-609c4c66-ba3d-43fa-afdd-53e244577aa0-2026-04-30T09-12-00-000Z.ndjson"
type: string
'400':
content:
application/json:
examples:
rowLimitExceeded:
summary: Result count exceeds the export limit
value:
message: Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.
schema:
type: object
properties:
message:
example: Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.
type: string
description: 'Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.
'
'403':
description: 'The authenticated user does not have the `osquery-readLiveQueries` privilege required to export live query results.
'
'404':
content:
application/json:
examples:
actionNotFound:
summary: The id/actionId pair refers to different queries
value:
message: Live query action not found
schema:
type: object
properties:
message:
example: Live query action not found
type: string
description: 'The parent live query action `{id}` was found but does not contain a query whose `action_id` matches `{actionId}`. This typically means the `id` and `actionId` URL parameters refer to different queries.
'
summary: Export live query results
tags:
- Security Osquery API
x-state: Generally available; Added in 9.5.0
x-metaTags:
- content: Kibana
name: product_name
/api/osquery/packs:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of all query packs.'
operationId: OsqueryFindPacks
parameters:
- description: The page number to return.
in: query
name: page
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
- description: The number of results to return per page.
in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
- description: The field to sort results by.
in: query
name: sort
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
- description: The sort order.
in: query
name: sortOrder
required: false
schema:
$ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
responses:
'200':
content:
application/json:
examples:
packsList:
summary: A list of query packs
value:
data:
- created_at: '2025-02-26T13:37:30.452Z'
created_by: elastic
description: My pack
enabled: true
name: my_pack
queries:
- id: ports
interval: 60
query: SELECT * FROM listening_ports;
removed: false
snapshot: true
timeout: 120
saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
updated_at: '2025-02-26T13:37:30.452Z'
updated_by: elastic
version: 1
page: 1
per_page: 20
total: 1
schema:
$ref: '#/components/schemas/Security_Osquery_API_FindPacksResponse'
description: Indicates a successful call.
summary: Get packs
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a query pack.'
operationId: OsqueryCreatePacks
requestBody:
content:
application/json:
examples:
createPack:
summary: Create a pack with a single query
value:
description: My pack
enabled: true
name: my_pack
policy_ids:
- my_policy_id
queries:
ports:
ecs_mapping:
client.port:
field: port
interval: 60
query: SELECT * FROM listening_ports;
timeout: 120
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreatePacksRequestBody'
required: true
responses:
'200':
content:
application/json:
examples:
packCreated:
summary: Pack created
value:
data:
created_at: '2025-02-26T13:37:30.452Z'
created_by: elastic
description: My pack
enabled: true
name: my_pack
policy_ids:
- my_policy_id
queries:
ports:
interval: 60
query: SELECT * FROM listening_ports;
removed: false
snapshot: true
timeout: 120
saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
shards: []
updated_at: '2025-02-26T13:37:30.452Z'
updated_by: elastic
version: 1
schema:
$ref: '#/components/schemas/Security_Osquery_API_CreatePacksResponse'
description: Indicates a successful call.
summary: Create a pack
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
/api/osquery/packs/{id}:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete a query pack using the pack ID.'
operationId: OsqueryDeletePacks
parameters:
- description: The pack ID.
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
responses:
'200':
content:
application/json:
examples:
packDeleted:
summary: Pack deleted (empty response body)
value: {}
schema:
type: object
properties: {}
description: Indicates a successful call.
summary: Delete a pack
tags:
- Security Osquery API
x-metaTags:
- content: Kibana
name: product_name
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the details of a query pack using the pack ID.'
operationId: OsqueryGetPacksDetails
parameters:
- description: The pack ID.
in: path
name: id
required: true
schema:
$ref: '#/components/schemas/Security_Osquery_API_PackId'
responses:
'200':
content:
application/json:
examples:
packDetails:
summary: Pack details
value:
data:
created_at: '2025-02-26T13:37:30.452Z'
created_by: elastic
description: My pack
enabled: true
# --- truncated at 32 KB (136 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-osquery-api-api-openapi.yml