Get notes

Server: https://{kibana_url}

GET /api/note
GET /s/{space_id}/api/note

Api key auth

Refer to Spaces for more information.

Returns Security Timeline notes as saved objects.

Query modes (mutually exclusive branches on the server):

documentIds is set — Returns notes whose eventId matches the given Elasticsearch document _id (single string or array). Pagination query parameters (page, perPage, etc.) are not applied; the server uses a fixed page size (up to 10000 notes).
savedObjectIds is set — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are not applied.
Neither documentIds nor savedObjectIds — Lists notes using saved-objects find semantics: page (default 1), perPage (default 10), optional search, sortField, sortOrder, filter, createdByFilter, and associatedFilter.

Requires the Timeline and Notes read privilege (notes_read).

Query Parameters

documentIds union: Event document _id values to match against each note's eventId. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using page/perPage.; One of: string[] or string
savedObjectIds union: Timeline savedObjectId value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.; One of: string[] or string
page string: Page number for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 1.
perPage string: Page size for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 10.
search string: Search string for saved-objects find (list mode only).
sortField string: Field to sort by for saved-objects find (list mode only).
sortOrder string: Sort order (asc or desc) for saved-objects find (list mode only).
filter string: Kuery filter string combined with other list-mode filters (for example createdByFilter or associatedFilter). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
createdByFilter string: Kibana user profile UID (UUID). The server resolves the user's display identifiers and returns notes whose createdBy matches any of them (list mode only).
associatedFilter enum: Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when documentIds or savedObjectIds is used.; Values: all document_only saved_object_only document_and_saved_object orphan

Response

Notes and total count for the requested mode.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/note

curl Shell

curl -X GET "https://{kibana_url}/api/note"

Response

{
  "notes": [
    {
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "Escalated to tier-2 analyst",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "version": "WzQ2LDFd"
    }
  ],
  "totalCount": 1
}

Query Parameters { documentIds , savedObjectIds , page , perPage , search , sortField , sortOrder , filter , createdByFilter , associatedFilter , }

Response

Query Parameters