itemThe item to pathAny (required)
patchA JSON Patch to applyAny
mergeA merge-patch to applyAny


Patch a JSON object with a json patch or merge.

The function allows for modifications of objects by way of applying a json patch. You can read more about JSON patching here

I practice you can use this to update server settings - for example, consider the client event monitoring state.

SELECT get_client_monitoring() FROM scope()
    "get_client_monitoring": {
      "artifacts": [

Suppose we wish to add a new artifact, we can patch it with the json:

[{"op": "add", "path": "/artifacts/0", "value": "Windows.Events.DNSQueries"}]

This can then be immediately pushed to set_client_monitoring() to update the monitoring state.

SELECT set_client_monitoring(value=patch(
       patch=[dict(op="add", path="/artifacts/0", value="Windows.Events.DNSQueries")]))
FROM scope()