Create a check definition

task australia Updated Sep 10, 2026 1 min read acc-api-check-def.md

Raw file servicenow.com

Create a check definition to execute the osquery command on the Agent.

Before you begin

Role required: agent_client_collector_integration or agent_client_collector_admin

Procedure

In an Event Management instance, navigate to Agent Client Collector > Check Definitions.
Click New.
In the Name field, enter util.osquery.
In the Check type field, enter osquery.

In the Command field, enter the following script:

Text

osqueryi  --logger_min_status 1 --json "{{.labels.params_query}} "

In the Plugins field, enter the osquery plugin.
In the Parameters section, enter the following values for a check parameter definition.

Column Value

Name query

Default value select * from logged_in_users

Mandatory true
Click Test check and select one of the available agents.

The test result appears, indicating its success or failure.

Column	Value
Name	query
Default value	select * from logged_in_users
Mandatory	true

54 lines · 1.6 KB Wrap lines

---
title: Create a check definition
description: Create a check definition to execute the osquery command on the Agent.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/agent-client-collector/acc-api-check-def.html
release: australia
product: Agent Client Collector
classification: agent-client-collector
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Collect data from your system devices, ACC deployment - shared between servers and endpoints, Configuring Agent Client Collector, Agent Client Collector, IT Operations Management]
---

# Create a check definition

Create a check definition to execute the `osquery` command on the Agent.

## Before you begin

Role required: agent\_client\_collector\_integration or agent\_client\_collector\_admin

## Procedure

1.  In an Event Management instance, navigate to **Agent Client Collector** &gt; **Check Definitions**.

2.  Click **New**.

3.  In the **Name** field, enter `util.osquery`.

4.  In the **Check type** field, enter `osquery`.

5.  In the **Command** field, enter the following script:

    ```
    osqueryi  --logger_min_status 1 --json "{{.labels.params_query}} "
    ```

6.  In the **Plugins** field, enter the `osquery` plugin.

7.  In the **Parameters** section, enter the following values for a check parameter definition.

    |Column|Value|
    |------|-----|
    |**Name**|query|
    |**Default value**|select \* from logged\_in\_users|
    |**Mandatory**|true|

8.  Click **Test check** and select one of the available agents.

    The test result appears, indicating its success or failure.