Get Timeline or Timeline template details

GET /api/timeline

Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/timeline

Refer to Spaces for more information.

Get the details of an existing saved Timeline or Timeline template.

Query parameters

template_timeline_id string

The savedObjectId of the template timeline to retrieve
id string

The savedObjectId of the Timeline to retrieve.

Responses

200 application/json

Indicates that the (template) Timeline was found and returned.
One of:
object-1 object object-2 object
Hide attribute Show attribute

data object Required

Hide data attribute Show data attribute object

getOneTimeline object

Hide getOneTimeline attributes Show getOneTimeline attributes object

columns array[object] | null

The Timeline's columns

Hide columns attributes Show columns attributes object

aggregatable boolean | null

category string | null

columnHeaderType string | null

description string | null

example string | null

id string | null

indexes array[string] | null

name string | null

placeholder string | null

searchable boolean | null

type string | null

created number | null

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string | null

The user who created the Timeline.

dataProviders array[object] | null

Object containing query clauses

Hide dataProviders attributes Show dataProviders attributes object

and array[object] | null

Hide and attributes Show and attributes object

enabled boolean | null

excluded boolean | null

id string | null

kqlQuery string | null

name string | null

queryMatch object

Hide queryMatch attributes Show queryMatch attributes object

displayField string | null

displayValue string | null

field string | null

operator string | null

value string | null | array[string]

One of:
string-1 string | null array-2 array[string] | null

type string

The type of data provider.

Values are default or template.

enabled boolean | null

excluded boolean | null

id string | null

kqlQuery string | null

name string | null

queryMatch object

Hide queryMatch attributes Show queryMatch attributes object

displayField string | null

displayValue string | null

field string | null

operator string | null

value string | null | array[string]

One of:
string-1 string | null array-2 array[string] | null

type string

The type of data provider.

Values are default or template.

dataViewId string | null

ID of the Timeline's Data View

dateRange object | null

The Timeline's search period.

Hide dateRange attributes Show dateRange attributes object | null

end string | null | number

One of:
string-1 string | null number-2 number | null

end string | null | number

One of:
string-1 string | null number-2 number | null

start string | null | number

One of:
string-1 string | null number-2 number | null

start string | null | number

One of:
string-1 string | null number-2 number | null

description string | null

The Timeline's description

eqlOptions object | null

EQL query that is used in the correlation tab

Hide eqlOptions attributes Show eqlOptions attributes object | null

eventCategoryField string | null

query string | null

size string | null | number

One of:
string-1 string | null number-2 number | null

size string | null | number

One of:
string-1 string | null number-2 number | null

tiebreakerField string | null

timestampField string | null

eventType string | null Deprecated

Event types displayed in the Timeline

excludedRowRendererIds array[string] | null

A list of row renderers that should not be used when in Event renderers mode

Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

favorite array[object] | null

Indicates when and who marked a Timeline as a favorite.

Hide favorite attributes Show favorite attributes object

favoriteDate number | null

fullName string | null

userName string | null

filters array[object] | null

A list of filters that should be applied to the query

Hide filters attributes Show filters attributes object

exists string | null

match_all string | null

meta object | null

Hide meta attributes Show meta attributes object | null

alias string | null

controlledBy string | null

disabled boolean | null

field string | null

formattedValue string | null

index string | null

key string | null

negate boolean | null

params string | null

type string | null

value string | null

missing string | null

query string | null

range string | null

script string | null

indexNames array[string] | null

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string | null

Indicates whether the KQL bar filters the query results or searches for additional results, where:

filter: filters query results

search: displays additional search results

kqlQuery object

KQL bar query.

Hide kqlQuery attribute Show kqlQuery attribute object

filterQuery object | null

Hide filterQuery attributes Show filterQuery attributes object | null

kuery object | null

Hide kuery attributes Show kuery attributes object | null

expression string | null

kind string | null

serializedQuery string | null

savedQueryId string | null

The ID of the saved query that might be used in the Query tab

savedSearchId string | null

The ID of the saved search that is used in the ES|QL tab

sort object | array[object]

One of:
Security_Timeline_API_SortObject object array-2 array[object]

Object indicating how rows are sorted in the Timeline's grid

Hide attributes Show attributes

columnId string | null

columnType string | null

sortDirection string | null

Object indicating how rows are sorted in the Timeline's grid

Hide attributes Show attributes object

columnId string | null

columnType string | null

sortDirection string | null

sort object | array[object]

One of:
Security_Timeline_API_SortObject object array-2 array[object]

Object indicating how rows are sorted in the Timeline's grid

Hide attributes Show attributes

columnId string | null

columnType string | null

sortDirection string | null

Object indicating how rows are sorted in the Timeline's grid

Hide attributes Show attributes object

columnId string | null

columnType string | null

sortDirection string | null

status string

The status of the Timeline.

Values are active, draft, or immutable.

templateTimelineId string | null

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number | null

Timeline template version number. For Timelines, the value is null.

timelineType string

The type of Timeline.

Values are default or template.

title string | null

The Timeline's title.

updated number | null

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string | null

The user who last updated the Timeline

savedObjectId string Required

The savedObjectId of the Timeline or Timeline template

version string Required

The version of the Timeline or Timeline template

eventIdToNoteIds array[object] | null

A list of all the notes that are associated to this Timeline.

Hide eventIdToNoteIds attributes Show eventIdToNoteIds attributes object

created number | null

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string | null

The user who created the note.

updated number | null

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string | null

The user who last updated the note

eventId string | null

The _id of the associated event for this note.

note string | null

The text of the note

timelineId string Required

The savedObjectId of the Timeline that this note is associated with

noteId string Required

The savedObjectId of the note

version string Required

The version of the note

noteIds array[string] | null

A list of all the ids of notes that are associated to this Timeline.

notes array[object] | null

A list of all the notes that are associated to this Timeline.

Hide notes attributes Show notes attributes object

created number | null

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string | null

The user who created the note.

updated number | null

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string | null

The user who last updated the note

eventId string | null

The _id of the associated event for this note.

note string | null

The text of the note

timelineId string Required

The savedObjectId of the Timeline that this note is associated with

noteId string Required

The savedObjectId of the note

version string Required

The version of the note

pinnedEventIds array[string] | null

A list of all the ids of pinned events that are associated to this Timeline.

pinnedEventsSaveObject array[object] | null

A list of all the pinned events that are associated to this Timeline.

Hide pinnedEventsSaveObject attributes Show pinnedEventsSaveObject attributes object

created number | null

The time the pinned event was created, using a 13-digit Epoch timestamp.

createdBy string | null

The user who created the pinned event.

updated number | null

The last time the pinned event was updated, using a 13-digit Epoch timestamp

updatedBy string | null

The user who last updated the pinned event

eventId string Required

The _id of the associated event for this pinned event.

timelineId string Required

The savedObjectId of the timeline that this pinned event is associated with

pinnedEventId string Required

The savedObjectId of this pinned event

version string Required

The version of this pinned event
Additional properties are NOT allowed.

GET /api/timeline

curl \
 --request GET 'https://localhost:5601/api/timeline' \
 --header "Authorization: $API_KEY"

Get Timeline or Timeline template details

Query parameters

Responses

value string | null | array[string]

value string | null | array[string]

end string | null | number

end string | null | number

start string | null | number

start string | null | number

size string | null | number

size string | null | number

sort object | array[object]

sort object | array[object]