---
title: stack kb security-timeline-api get-timelines cli command
description: Get Timelines or Timeline templates Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4120/reference/elastic-cli/cli/stack/kb/security-timeline-api/get-timelines
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-timeline-api get-timelines cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-timeline-api get-timelines [options]
```

Get Timelines or Timeline templates
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--only-user-favorite enum">
    If `true`, only Timelines that the current user has marked as favorite are returned.
    **Values:** true, false
  </definition>
  <definition term="--timeline-type enum">
    Restrict results to `default` investigation timelines or `template` timeline templates.
    **Values:** default, template
  </definition>
  <definition term="--sort-field enum">
    Field used to sort the list (`title`, `description`, `updated`, or `created`).
    **Values:** title, description, updated, created
  </definition>
  <definition term="--sort-order enum">
    Whether to sort the results `ascending` or `descending`
    **Values:** asc, desc
  </definition>
  <definition term="--page-size string">
    How many results should returned at once
  </definition>
  <definition term="--page-index string">
    How many pages should be skipped
  </definition>
  <definition term="--search string">
    Allows to search for timelines by their title
  </definition>
  <definition term="--status enum">
    Filter by timeline lifecycle state (`active`, `draft`, or `immutable`).
    **Values:** active, draft, immutable
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>