Get Timelines or Timeline templates
https://{kibana_url}
- GET /api/timelines
Get a list of all saved Timelines or Timeline templates.
Query Parameters
-
only_user_favorite If
true, only Timelines that the current user has marked as favorite are returned.-
Values:
truefalse -
timeline_type Restrict results to
defaultinvestigation timelines ortemplatetimeline templates.-
Values:
defaulttemplate -
sort_field Field used to sort the list (
title,description,updated, orcreated).-
Values:
titledescriptionupdatedcreated -
page_sizestring How many results should returned at once
-
page_indexstring How many pages should be skipped
-
searchstring Allows to search for timelines by their title
-
status Filter by timeline lifecycle state (
active,draft, orimmutable).-
Values:
activedraftimmutable
Responses
Indicates a successful call.
-
customTemplateTimelineCountnumber -
The amount of custom Timeline templates in the results
-
defaultTimelineCountnumber -
The amount of
defaulttype Timelines in the results -
elasticTemplateTimelineCountnumber -
The amount of Elastic's Timeline templates in the results
-
favoriteCountnumber -
The amount of favorited Timelines
-
templateTimelineCountnumber -
The amount of Timeline templates in the results
-
timelineobjectrequired -
columnsobjectnullable -
The Timeline's columns
-
aggregatablebooleannullable -
categorystringnullable -
columnHeaderTypestringnullable -
descriptionstringnullable -
examplestringnullable -
idstringnullable -
indexesstringnullable -
namestringnullable -
placeholderstringnullable -
searchablebooleannullable -
typestringnullable -
creatednumbernullable -
The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the Timeline.
-
dataProvidersobjectnullable -
Object containing query clauses
-
andobjectnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
dataViewIdstringnullable -
ID of the Timeline's Data View
-
dateRangeobjectnullable -
The Timeline's search period.
-
descriptionstringnullable -
The Timeline's description
-
eqlOptionsobjectnullable -
EQL query that is used in the correlation tab
-
eventCategoryFieldstringnullable -
querystringnullable -
sizestring | numbernullable -
tiebreakerFieldstringnullable -
timestampFieldstringnullable -
eventTypestringnullable deprecated -
Event types displayed in the Timeline
-
excludedRowRendererIds -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
favoriteobjectnullable -
favoriteDatenumbernullable -
fullNamestringnullable -
userNamestringnullable -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
kqlQuery -
KQL bar query.
-
filterQueryobjectnullable -
kueryobjectnullable -
expressionstringnullable -
kindstringnullable -
serializedQuerystringnullable -
savedQueryIdstringnullable -
The ID of the saved query that might be used in the Query tab
-
savedSearchIdstringnullable -
The ID of the saved search that is used in the ES|QL tab
-
sort -
columnIdstringnullable -
columnTypestringnullable -
sortDirectionstringnullable -
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
titlestringnullable -
The Timeline's title.
-
updatednumbernullable -
The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the Timeline
-
savedObjectIdstringrequired -
The
savedObjectIdof the Timeline or Timeline template -
versionstringrequired -
The version of the Timeline or Timeline template
-
eventIdToNoteIdsobjectnullable -
A list of all the notes that are associated to this Timeline.
-
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
Elasticsearch document
_idfor the event or alert this note refers to. Same value as thedocumentIdsquery parameter when fetching notes via GET /api/note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline this note belongs to (not the note's own ID). -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
noteIdsstringnullable -
A list of all the ids of notes that are associated to this Timeline.
-
notesobjectnullable -
A list of all the notes that are associated to this Timeline.
-
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
Elasticsearch document
_idfor the event or alert this note refers to. Same value as thedocumentIdsquery parameter when fetching notes via GET /api/note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline this note belongs to (not the note's own ID). -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
pinnedEventIdsstringnullable -
A list of all the ids of pinned events that are associated to this Timeline.
-
pinnedEventsSaveObjectobjectnullable -
A list of all the pinned events that are associated to this Timeline.
-
creatednumbernullable -
The time the pinned event was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the pinned event.
-
updatednumbernullable -
The last time the pinned event was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the pinned event
-
eventIdstringrequired -
The
_idof the associated event for this pinned event. -
timelineIdstringrequired -
The
savedObjectIdof the timeline that this pinned event is associated with -
pinnedEventIdstringrequired -
The
savedObjectIdof this pinned event -
versionstringrequired -
The version of this pinned event
-
totalCountnumberrequired -
The total amount of results
Bad Request response.
-
bodystring -
The error message.
-
statusCodenumber