From a78073bcb92d11632b862967f73d77ac71e16774 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 7 Jul 2026 15:18:00 +0200 Subject: [PATCH 1/3] [Osquery_manager] Add pack_name and query_name fields for scheduled queries Add pack_name and query_name keyword fields to the result and action_responses data streams. Osquerybeat now emits these on scheduled pack query result and response documents (pack_name from the pack config, query_name from the pack's queries config map key). The Osquery Manager dashboards need them to group and label scheduled query results by pack and query name. --- packages/osquery_manager/changelog.yml | 5 +++++ .../action_responses/fields/action-responses.yml | 8 ++++++++ .../data_stream/result/fields/primary-fields.yml | 6 ++++++ packages/osquery_manager/manifest.yml | 2 +- 4 files changed, 20 insertions(+), 1 deletion(-) diff --git a/packages/osquery_manager/changelog.yml b/packages/osquery_manager/changelog.yml index 1c43c7fffb9..dbe281be463 100644 --- a/packages/osquery_manager/changelog.yml +++ b/packages/osquery_manager/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.30.1" + changes: + - description: Add `pack_name` and `query_name` fields to the result and action_responses data streams for scheduled pack queries. + type: bugfix + link: https://github.com/elastic/integrations/pull/51782 - version: "1.30.0" changes: - description: Add Process_open_handles query and pack diff --git a/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml b/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml index c6f2a53be83..e91f46747ee 100644 --- a/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml +++ b/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml @@ -32,6 +32,14 @@ type: keyword ignore_above: 1024 description: Pack identifier for scheduled queries that belong to a pack. +- name: pack_name + type: keyword + ignore_above: 1024 + description: Human-readable pack name for scheduled queries that belong to a pack. +- name: query_name + type: keyword + ignore_above: 1024 + description: Query name (the pack's queries config map key) for scheduled queries that belong to a pack. - name: response_id type: keyword ignore_above: 1024 diff --git a/packages/osquery_manager/data_stream/result/fields/primary-fields.yml b/packages/osquery_manager/data_stream/result/fields/primary-fields.yml index 6a20ed96834..0ccf90f9883 100644 --- a/packages/osquery_manager/data_stream/result/fields/primary-fields.yml +++ b/packages/osquery_manager/data_stream/result/fields/primary-fields.yml @@ -7,6 +7,12 @@ - name: pack_id type: keyword description: Pack identifier for scheduled queries that belong to a pack. +- name: pack_name + type: keyword + description: Human-readable pack name for scheduled queries that belong to a pack. +- name: query_name + type: keyword + description: Query name (the pack's queries config map key) for scheduled queries that belong to a pack. - name: response_id type: keyword description: Query response id. Present only for scheduled queries. diff --git a/packages/osquery_manager/manifest.yml b/packages/osquery_manager/manifest.yml index cf7300913e4..0a7807a4a3d 100644 --- a/packages/osquery_manager/manifest.yml +++ b/packages/osquery_manager/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.5.8 name: osquery_manager title: Osquery Manager -version: 1.30.0 +version: 1.30.1 description: Deploy Osquery with Elastic Agent, then run and schedule queries in Kibana type: integration categories: From b6083d6a4480895c05549c5ac424400fd79dc5d6 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 7 Jul 2026 15:18:44 +0200 Subject: [PATCH 2/3] Update changelog link to PR #20017 --- packages/osquery_manager/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/osquery_manager/changelog.yml b/packages/osquery_manager/changelog.yml index dbe281be463..3fe5b297900 100644 --- a/packages/osquery_manager/changelog.yml +++ b/packages/osquery_manager/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add `pack_name` and `query_name` fields to the result and action_responses data streams for scheduled pack queries. type: bugfix - link: https://github.com/elastic/integrations/pull/51782 + link: https://github.com/elastic/integrations/pull/20017 - version: "1.30.0" changes: - description: Add Process_open_handles query and pack From c1c9292a753f92533343b8d1cd801de91f5d8380 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Wed, 8 Jul 2026 11:13:27 +0200 Subject: [PATCH 3/3] [Osquery_manager] Update legacy pack dashboards and searches for pack_name/query_name Update the Compliance pack and OSSEC rootkit pack dashboards and their saved searches to match scheduled queries by action_id OR (pack_name AND query_name), so they keep working for both legacy documents and documents produced after osquerybeat stopped setting action_id for scheduled queries. --- packages/osquery_manager/changelog.yml | 3 + ...-69f5ae20-eb02-11e7-8f04-51231daa5b05.json | 76 ++++++++++++++----- ...-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json | 54 ++++++++----- ...-0fe5dc00-f49b-11e7-8647-534bb4c21040.json | 27 ++++--- ...-3824b080-eb02-11e7-8f04-51231daa5b05.json | 38 +++++++--- ...-7a9482d0-eb00-11e7-8f04-51231daa5b05.json | 38 +++++++--- ...-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json | 2 +- ...-f59e21e0-eb03-11e7-8f04-51231daa5b05.json | 2 +- 8 files changed, 175 insertions(+), 65 deletions(-) diff --git a/packages/osquery_manager/changelog.yml b/packages/osquery_manager/changelog.yml index 3fe5b297900..85efa174c98 100644 --- a/packages/osquery_manager/changelog.yml +++ b/packages/osquery_manager/changelog.yml @@ -4,6 +4,9 @@ - description: Add `pack_name` and `query_name` fields to the result and action_responses data streams for scheduled pack queries. type: bugfix link: https://github.com/elastic/integrations/pull/20017 + - description: Update legacy pack dashboards and saved searches to also match scheduled queries by `pack_name` and `query_name` instead of `action_id` only. + type: bugfix + link: https://github.com/elastic/integrations/pull/20017 - version: "1.30.0" changes: - description: Add Process_open_handles query and pack diff --git a/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json index d22949c150e..07c1420f291 100644 --- a/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json @@ -428,20 +428,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / mounts", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_mounts" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_mounts\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"mounts\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_mounts" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_mounts" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "mounts" + } + } + ] + } + } + ] } } } @@ -656,20 +676,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / kernel_integrations", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_kernel_integrations" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_kernel_integrations\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"kernel_integrations\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_kernel_integrations" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_kernel_integrations" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "kernel_integrations" + } + } + ] + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json index 6473471b675..ec542584d8e 100644 --- a/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json +++ b/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json @@ -229,20 +229,29 @@ }, { "meta": { - "alias": null, + "alias": "ossec-rootkit", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_ossec-rootkit" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_ossec-rootkit\"}},{\"match_phrase\":{\"pack_name\":\"ossec-rootkit\"}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_ossec-rootkit" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + }, + { + "match_phrase": { + "pack_name": "ossec-rootkit" + } + } + ] } } } @@ -405,20 +414,29 @@ }, { "meta": { - "alias": null, + "alias": "ossec-rootkit", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_ossec-rootkit" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_ossec-rootkit\"}},{\"match_phrase\":{\"pack_name\":\"ossec-rootkit\"}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_ossec-rootkit" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + }, + { + "match_phrase": { + "pack_name": "ossec-rootkit" + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json index 972b8d13ee8..fba7d39a2ba 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json @@ -44,20 +44,29 @@ }, { "meta": { - "alias": null, + "alias": "ossec-rootkit", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_ossec-rootkit" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_ossec-rootkit\"}},{\"match_phrase\":{\"pack_name\":\"ossec-rootkit\"}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_ossec-rootkit" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + }, + { + "match_phrase": { + "pack_name": "ossec-rootkit" + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json index ef29d27b432..1fc0797335b 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json @@ -44,20 +44,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / deb_packages", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_deb_packages" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_deb_packages\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"deb_packages\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_deb_packages" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_deb_packages" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "deb_packages" + } + } + ] + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json index f19761c09b3..a37e1eadada 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json @@ -44,20 +44,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / mounts", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_mounts" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_mounts\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"mounts\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_mounts" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_mounts" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "mounts" + } + } + ] + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json index 931ef14b4ba..c473b160dcd 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json @@ -6,7 +6,7 @@ "description": "", "hits": 0, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_it-compliance_os_version\"},\"version\":true}" + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:\\\"pack_it-compliance_os_version\\\" or (pack_name:\\\"it-compliance\\\" and query_name:\\\"os_version\\\")\"},\"version\":true}" }, "sort": [ [ diff --git a/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json index c23bb0dec5e..75e476ebdfa 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json @@ -8,7 +8,7 @@ "description": "", "hits": 0, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_it-compliance_kernel_integrations\"},\"version\":true}" + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:\\\"pack_it-compliance_kernel_integrations\\\" or (pack_name:\\\"it-compliance\\\" and query_name:\\\"kernel_integrations\\\")\"},\"version\":true}" }, "sort": [ [