Headers

• kbn-xsrf string Required

  A required header to protect against CSRF attacks

Query parameters

• format string

  Values are simplified or legacy.

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • items array[object] Required
    Hide items attributes Show items attributes object

    • advanced_settings object

      Additional properties are NOT allowed.

      Hide advanced_settings attributes Show advanced_settings attributes object

      • agent_download_target_directory
      • agent_download_timeout
      • agent_limits_go_max_procs
      • agent_logging_files_interval
      • agent_logging_files_keepfiles
      • agent_logging_files_rotateeverybytes
      • agent_logging_level
      • agent_logging_metrics_period
      • agent_logging_to_files
    • agent_features array[object]
      Hide agent_features attributes Show agent_features attributes object

      • enabled boolean Required
      • name string Required
    • agentless object

      Additional properties are NOT allowed.

      Hide agentless attributes Show agentless attributes object

      • cloud_connectors object

        Additional properties are NOT allowed.

        Hide cloud_connectors attributes Show cloud_connectors attributes object

        • enabled boolean Required
        • target_csp string
      • resources object

        Additional properties are NOT allowed.

        Hide resources attribute Show resources attribute object

        • requests object

          Additional properties are NOT allowed.

          Hide requests attributes Show requests attributes object

          • cpu string
          • memory string
    • agents number
    • data_output_id string | null
    • description string
    • download_source_id string | null
    • fleet_server_host_id string | null
    • global_data_tags array[object]

      User defined data tags that are added to all of the inputs. The values can be strings or numbers.

      Hide global_data_tags attributes Show global_data_tags attributes object

      • name string Required

      • value string | number Required

        Any of:

        string-1 string number-2 number
    • has_fleet_server boolean
    • id string Required
    • inactivity_timeout number

      Minimum value is 0. Default value is 1209600.

    • is_default boolean
    • is_default_fleet_server boolean
    • is_managed boolean Required
    • is_preconfigured boolean
    • is_protected boolean Required

      Indicates whether the agent policy has tamper protection enabled. Default false.

    • keep_monitoring_alive boolean | null

      When set to true, monitoring will be enabled but logs/metrics collection will be disabled

      Default value is false.

    • monitoring_diagnostics object

      Additional properties are NOT allowed.

      Hide monitoring_diagnostics attributes Show monitoring_diagnostics attributes object

      • limit object

        Additional properties are NOT allowed.

        Hide limit attributes Show limit attributes object

        • burst number
        • interval string
      • uploader object

        Additional properties are NOT allowed.

        Hide uploader attributes Show uploader attributes object

        • init_dur string
        • max_dur string
        • max_retries number
    • monitoring_enabled array[string]

      Values are logs, metrics, or traces.

    • monitoring_http object

      Additional properties are NOT allowed.

      Hide monitoring_http attributes Show monitoring_http attributes object

      • buffer object

        Additional properties are NOT allowed.

        Hide buffer attribute Show buffer attribute object

        • enabled boolean

          Default value is false.

      • enabled boolean
      • host string
      • port number

        Minimum value is 0, maximum value is 65353.

    • monitoring_output_id string | null
    • monitoring_pprof_enabled boolean
    • name string Required

      Minimum length is 1.

    • namespace string Required

      Minimum length is 1.

    • overrides object | null

      Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.

      Additional properties are allowed.

    • package_policies array[string] | array[object]

      Any of:

      array-1 array[string] array-2 array[object]

      This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter

      Hide attributes Show attributes object

      • additional_datastreams_permissions array[string] | null

        Additional datastream permissions, that will be added to the agent policy.

      • agents number
      • created_at string Required
      • created_by string Required
      • description string

        Package policy description

      • elasticsearch object

        Additional properties are allowed.

        Hide elasticsearch attribute Show elasticsearch attribute object

        • privileges object

          Additional properties are allowed.

          Hide privileges attribute Show privileges attribute object

          • cluster array[string]
      • enabled boolean Required
      • id string Required

      • inputs array[object] | object Required

        Any of:

        array-1 array[object] object-2 object

        Hide attributes Show attributes object

        • config object

          Package variable (see integration documentation for more information)

          Hide config attribute Show config attribute object

          • * object Additional properties

            Additional properties are NOT allowed.

            Hide * attributes Show * attributes object

            • frozen boolean
            • type string
        • enabled boolean Required
        • id string
        • keep_enabled boolean
        • policy_template string
        • streams array[object] Required
          Hide streams attributes Show streams attributes object

          • config object

            Package variable (see integration documentation for more information)

            Hide config attribute Show config attribute object

            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object

              • frozen boolean
              • type string
          • data_stream object Required

            Additional properties are NOT allowed.

            Hide data_stream attributes Show data_stream attributes object

            • dataset string Required
            • elasticsearch object

              Additional properties are NOT allowed.

              Hide elasticsearch attributes Show elasticsearch attributes object

              • dynamic_dataset boolean
              • dynamic_namespace boolean
              • privileges object

                Additional properties are NOT allowed.

                Hide privileges attribute Show privileges attribute object

                • indices array[string]
            • type string Required
          • enabled boolean Required
          • id string
          • keep_enabled boolean
          • release string

            Values are ga, beta, or experimental.

          • vars object

            Package variable (see integration documentation for more information)

            Hide vars attribute Show vars attribute object

            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object

              • frozen boolean
              • type string
        • type string Required
        • vars object

          Package variable (see integration documentation for more information)

          Hide vars attribute Show vars attribute object

          • * object Additional properties

            Additional properties are NOT allowed.

            Hide * attributes Show * attributes object

            • frozen boolean
            • type string

        Package policy inputs (see integration documentation to know what inputs are available)

        Hide attribute Show attribute

        • * object Additional properties

          Additional properties are NOT allowed.

          Hide * attributes Show * attributes object

          • enabled boolean

            enable or disable that input, (default to true)

          • streams object

            Input streams (see integration documentation to know what streams are available)

            Hide streams attribute Show streams attribute object

            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object

              • enabled boolean

                enable or disable that stream, (default to true)

              • vars object

                Input/stream level variable (see integration documentation for more information)

          • vars object

            Input/stream level variable (see integration documentation for more information)

      • is_managed boolean
      • name string Required

        Package policy name (should be unique)

      • namespace string

        The package policy namespace. Leave blank to inherit the agent policy's namespace.

      • output_id string | null
      • overrides object | null

        Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

        Additional properties are NOT allowed.

        Hide overrides attribute Show overrides attribute object | null

        • inputs object

          Additional properties are allowed.

      • package object

        Additional properties are NOT allowed.

        Hide package attributes Show package attributes object

        • experimental_data_stream_features array[object]
          Hide experimental_data_stream_features attributes Show experimental_data_stream_features attributes object

          • data_stream string Required
          • features object Required

            Additional properties are NOT allowed.

            Hide features attributes Show features attributes object

            • doc_value_only_numeric boolean
            • doc_value_only_other boolean
            • synthetic_source boolean
            • tsdb boolean
        • name string Required

          Package name

        • requires_root boolean
        • title string
        • version string Required

          Package version

      • policy_id string | null Deprecated

        Agent policy ID where that package policy will be added

      • policy_ids array[string]

        Agent policy IDs where that package policy will be added

      • revision number Required
      • secret_references array[object]
        Hide secret_references attribute Show secret_references attribute object

        • id string Required
      • spaceIds array[string]
      • supports_agentless boolean | null

        Indicates whether the package policy belongs to an agentless agent policy.

        Default value is false.

      • updated_at string Required
      • updated_by string Required

      • vars object

        Any of:

        object-1 object object-2 object

        Package variable (see integration documentation for more information)

        Hide attribute Show attribute

        • * object Additional properties

          Additional properties are NOT allowed.

          Hide * attributes Show * attributes object

          • frozen boolean
          • type string

        Input/stream level variable (see integration documentation for more information)

      • version string
    • required_versions array[object] | null
      Hide required_versions attributes Show required_versions attributes object

      • percentage number Required

        Target percentage of agents to auto upgrade

        Minimum value is 0, maximum value is 100.

      • version string Required

        Target version for automatic agent upgrade

    • revision number Required
    • schema_version string
    • space_ids array[string]
    • status string Required

      Values are active or inactive.

    • supports_agentless boolean | null

      Indicates whether the agent policy supports agentless integrations.

      Default value is false.

    • unenroll_timeout number

      Minimum value is 0.

    • unprivileged_agents number
    • updated_at string Required
    • updated_by string Required
    • version string
• 400 application/json
  Hide response attributes Show response attributes object

  • error string
  • errorType string
  • message string Required
  • statusCode number