Osquery Manager Feedback - OSQuery manager API needed for automatically downloading Elastic packs


Is there a Kibana API I can use to automatically download and install the Elastic created OSquery manager packs? There are several APIs available documented here, Osquery manager API | Kibana Guide [8.4] | Elastic, but none achieve my goal of downloading the Elastic packs automatically.

For context: Without having an API to trigger automatically loading OSquery packs I will not be able to automate this step when enabling Elastic Security and the OSquery manager integration on 24 of my production clusters. Instead I will have to manually log into each individual cluster Kibana UI, manage the OSquery manager integration, then click the "load elastic created packs" button. Minor annoyance, but not a deal breaker.

Hey Joe,

I spoke with the team and tested out (using curl) an authenticated POST to https://<kibana_url>/internal/osquery/assets/update. That POST requested installed the packages that are shipped by Elastic's OSquery manager integration so you wouldn't have to log into all of your clusters.

A sample response that I received from the POST:

Thanks for reaching out! Let us know if you have any other questions.

1 Like

Thank you for this!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.