Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

#14415 API design: Per-host query report endpoint (#14805)

Browse Source 
Adds new API endpoint to enable displaying query reports per-host
(#14415).

---------

Co-authored-by: Tim Lee <timlee@fleetdm.com>
This commit is contained in:
Rachael Shaw
2023-12-15 12:27:20 -06:00
committed by GitHub
co-authored by Tim Lee
parent 024a20ac11
commit 5e3f501c87
1 changed files with 70 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/REST API/rest-api.md
+70 -3
View File
@@ -5536,6 +5536,7 @@ Either `query` or `query_id` must be provided.
- [List queries](#list-queries)
- [Get query](#get-query)
- [Get query report](#get-query-report)
- [Get query report for one host](#get-query-report-for-one-host)
- [Create query](#create-query)
- [Modify query](#modify-query)
- [Delete query by name](#delete-query-by-name)
@@ -5721,9 +5722,9 @@ Returns the query report specified by ID.
#### Parameters
| Name | Type | In | Description |
| ---- | ------- | ---- | ------------------------------------------ |
| id | integer | path | **Required**. The ID of the desired query. |
| Name | Type | In | Description |
| --------- | ------- | ----- | ------------------------------------------ |
| id | integer | path | **Required**. The ID of the desired query. |
#### Example
@@ -5797,6 +5798,72 @@ If a query has no results stored, then `results` will be an empty array:
> Note: osquery scheduled queries do not return errors, so only non-error results are included in the report. If you suspect a query may be running into errors, you can use the [live query](#run-live-query) endpoint to get diagnostics.
### Get query report for one host
Returns a query report for a single host.
`GET /api/v1/fleet/hosts/:id/queries/:query_id`
#### Parameters
| Name | Type | In | Description |
| --------- | ------- | ----- | ------------------------------------------ |
| id | integer | path | **Required**. The ID of the desired host. |
| query_id | integer | path | **Required**. The ID of the desired query. |
#### Example
`GET /api/v1/fleet/hosts/123/queries/31`
##### Default response
`Status: 200`
```json
{
"query_id": 31,
"host_id": 1,
"host_name": "foo",
"last_fetched": "2021-01-19T17:08:31Z",
"report_clipped": false,
"results": [
{
"columns": {
"model": "USB 2.0 Hub",
"vendor": "VIA Labs, Inc."
}
},
{
"columns": {
"model": "USB Keyboard",
"vendor": "VIA Labs, Inc."
}
},
{
"columns": {
"model": "USB Reciever",
"vendor": "Logitech"
}
}
]
}
```
If a query has no results stored for the specified host, then `results` will be an empty array:
```json
{
"query_id": 31,
"host_id": 1,
"host_name": "foo",
"last_fetched": "2021-01-19T17:08:31Z",
"report_clipped": false,
"results": []
}
```
> Note: osquery scheduled queries do not return errors, so only non-error results are included in the report. If you suspect a query may be running into errors, you can use the [live query](#run-live-query) endpoint to get diagnostics.
### Create query
Creates a global query or team query.