Elastic Stack

Elastic Stack (ELK Stack) Security Osquery API

Run live queries, manage packs and saved queries.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 21

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/osquery/history View combined osquery execution history · Get unified query history #
Ask an LLM
“Can I see live, rule-triggered and scheduled osquery runs in one timeline?”
“Which osquery executions ran between two dates?”
Tell an agent
Show my unified osquery history from {startDate} to {endDate}.
List osquery executions run by users {userIds}.
GET /api/osquery/live_queries List live osquery queries · Get live queries #
Ask an LLM
“Which live queries have been run against my hosts?”
“Can I filter the list of live queries with KQL?”
Tell an agent
List all live osquery queries.
Find live queries matching {kuery}, sorted by {sort}.
POST /api/osquery/live_queries Run a live osquery query on hosts · Create a live query #
Ask an LLM
“How do I run an osquery SQL query on my endpoints right now?”
“Can I target a live query at a specific agent policy or platform?”
Tell an agent
Run live query {query} on agents {agent_ids}.
Run live query {query} on every agent in policies {agent_policy_ids}.
GET /api/osquery/live_queries/{id} Get a live query's details · Get live query details #
Ask an LLM
“What queries and agents were part of a specific live query run?”
“Can I check the status of a live query I launched?”
Tell an agent
Get the details of live query {id}.
Show which agents live query {id} targeted.
GET /api/osquery/live_queries/{id}/results/{actionId} Get the result rows of a live query · Get live query results #
Ask an LLM
“Where do I see the rows my live osquery query returned?”
“Can I page through live query results and filter them?”
Tell an agent
Show results of action {actionId} in live query {id}.
Page {page} of live query {id} action {actionId} results filtered by {kuery}.
POST /api/osquery/live_queries/{id}/results/{actionId}/_export Download live query results as a file · Export live query results #
Ask an LLM
“Can I download a live query's results as a file?”
“Which file formats can live osquery results be exported in?”
Tell an agent
Export live query {id} action {actionId} results as {format}.
Download {format} results of live query {id} action {actionId} for agents {agentIds}.
GET /api/osquery/packs List osquery packs · Get packs #
Ask an LLM
“What osquery query packs do I have?”
“Can I sort my query packs by name?”
Tell an agent
List all osquery packs.
Show page {page} of query packs sorted by {sort}.
POST /api/osquery/packs Create an osquery pack · Create a pack #
Ask an LLM
“How do I bundle several scheduled osquery queries into a pack?”
“Can I assign a new pack to specific agent policies?”
Tell an agent
Create pack {name} with queries {queries}.
Create an enabled pack {name} assigned to policies {policy_ids}.
DELETE /api/osquery/packs/{id} Delete an osquery pack · Delete a pack #
Ask an LLM
“How do I remove a query pack I no longer use?”
“Does deleting a pack stop its scheduled queries?”
Tell an agent destructive · confirm first
Delete osquery pack {id}.
Remove pack {id}.
GET /api/osquery/packs/{id} Get an osquery pack · Get pack details #
Ask an LLM
“Which queries are inside a given osquery pack?”
“What schedule and policies does a pack use?”
Tell an agent
Get the details of pack {id}.
Show the queries in osquery pack {id}.
PUT /api/osquery/packs/{id} Update an osquery pack · Update a pack #
Ask an LLM
“Can I change the queries or schedule of an existing pack?”
“Why can't I edit a prebuilt osquery pack?”
Tell an agent
Update pack {id} with queries {queries}.
Disable pack {id} by setting enabled to {enabled}.
POST /api/osquery/packs/{id}/copy Duplicate an osquery pack · Copy a pack #
Ask an LLM
“Can I clone a query pack so I can edit the copy?”
“What name does a copied pack get, and is it enabled?”
Tell an agent
Copy pack {id}.
Make a disabled duplicate of osquery pack {id}.
GET /api/osquery/saved_queries List saved osquery queries · Get saved queries #
Ask an LLM
“What saved osquery queries are available to reuse?”
“Can I page through saved queries sorted by a field?”
Tell an agent
List all saved osquery queries.
Show page {page} of saved queries, {pageSize} per page.
POST /api/osquery/saved_queries Save an osquery query for reuse · Create a saved query #
Ask an LLM
“How do I save an osquery SQL statement so I can run it later?”
“Can a saved query be limited to one platform?”
Tell an agent
Save query {query} with id {id}.
Save osquery {query} for platform {platform} as {id}.
DELETE /api/osquery/saved_queries/{id} Delete a saved osquery query · Delete a saved query #
Ask an LLM
“How do I delete a saved osquery query?”
“Is removing a saved query permanent?”
Tell an agent destructive · confirm first
Delete saved query {id}.
Remove the saved osquery query {id}.
GET /api/osquery/saved_queries/{id} Get a saved osquery query · Get saved query details #
Ask an LLM
“What SQL and ECS mapping does a particular saved query use?”
“Can I look up one saved query by id?”
Tell an agent
Get saved query {id}.
Show the SQL of saved query {id}.
PUT /api/osquery/saved_queries/{id} Update a saved osquery query · Update a saved query #
Ask an LLM
“Can I edit the SQL of a query I saved earlier?”
“Are prebuilt saved queries editable?”
Tell an agent
Change saved query {id} to run {query}.
Update the interval of saved query {id} to {interval}.
POST /api/osquery/saved_queries/{id}/copy Duplicate a saved osquery query · Copy a saved query #
Ask an LLM
“Can I clone a saved query as a starting point for a new one?”
“What suffix is added to a copied saved query's name?”
Tell an agent
Copy saved query {id}.
Make a duplicate of saved osquery query {id}.
GET /api/osquery/scheduled_results/{scheduleId}/{executionCount} Get per-agent status of a scheduled query run · Get scheduled action results #
Ask an LLM
“Which agents succeeded or failed on a particular scheduled osquery execution?”
“Can I see success and failure counts for one scheduled query run?”
Tell an agent
Show per-agent results for schedule {scheduleId} execution {executionCount}.
List failing agents in scheduled run {executionCount} of {scheduleId}.
POST /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export Download scheduled query results as a file · Export scheduled query results #
Ask an LLM
“Can I export every row from a scheduled osquery execution to a file?”
“Which formats can scheduled query results be downloaded in?”
Tell an agent
Export schedule {scheduleId} run {executionCount} results as {format}.
Download {format} rows of scheduled run {executionCount} of {scheduleId} filtered by {kuery}.
GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results Get the data rows of a scheduled query run · Get scheduled query results #
Ask an LLM
“What actual osquery output did a scheduled query return on one run?”
“Can I page through scheduled query result rows from a start date?”
Tell an agent
Show the result rows of schedule {scheduleId} execution {executionCount}.
Get page {page} of output rows for scheduled run {executionCount} of {scheduleId}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-osquery-api-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-osquery-api-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-osquery-api-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Security Osquery API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (131 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-osquery-api-api-openapi.yml