Install prepackaged Timelines
https://{kibana_url}
- POST /api/timeline/_prepackaged
- POST /s/{space_id}/api/timeline/_prepackaged
Refer to Spaces for more information.
Install or update prepackaged Timelines.
Request
The Timelines to install or update.
-
prepackagedTimelinesobjectrequired -
columnsobjectnullable -
The Timeline's columns
-
aggregatablebooleannullable -
categorystringnullable -
columnHeaderTypestringnullable -
descriptionstringnullable -
examplestringnullable -
idstringnullable -
indexesstringnullable -
namestringnullable -
placeholderstringnullable -
searchablebooleannullable -
typestringnullable -
creatednumbernullable -
The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the Timeline.
-
dataProvidersobjectnullable -
Object containing query clauses
-
andobjectnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
dataViewIdstringnullable -
ID of the Timeline's Data View
-
dateRangeobjectnullable -
The Timeline's search period.
-
descriptionstringnullable -
The Timeline's description
-
eqlOptionsobjectnullable -
EQL query that is used in the correlation tab
-
eventCategoryFieldstringnullable -
querystringnullable -
sizestring | numbernullable -
tiebreakerFieldstringnullable -
timestampFieldstringnullable -
eventTypestringnullable deprecated -
Event types displayed in the Timeline
-
excludedRowRendererIds -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
favoriteobjectnullable -
favoriteDatenumbernullable -
fullNamestringnullable -
userNamestringnullable -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
kqlQuery -
KQL bar query.
-
filterQueryobjectnullable -
kueryobjectnullable -
expressionstringnullable -
kindstringnullable -
serializedQuerystringnullable -
savedQueryIdstringnullable -
The ID of the saved query that might be used in the Query tab
-
savedSearchIdstringnullable -
The ID of the saved search that is used in the ES|QL tab
-
sort -
columnIdstringnullable -
columnTypestringnullable -
sortDirectionstringnullable -
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
titlestringnullable -
The Timeline's title.
-
updatednumbernullable -
The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the Timeline
-
eventIdToNoteIdsobjectnullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
noteIdsstringnullable -
notesobjectnullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
pinnedEventIdsstringnullable -
pinnedEventsSaveObjectobjectnullable -
creatednumbernullable -
The time the pinned event was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the pinned event.
-
updatednumbernullable -
The last time the pinned event was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the pinned event
-
eventIdstringrequired -
The
_idof the associated event for this pinned event. -
timelineIdstringrequired -
The
savedObjectIdof the timeline that this pinned event is associated with -
pinnedEventIdstringrequired -
The
savedObjectIdof this pinned event -
versionstringrequired -
The version of this pinned event
-
savedObjectIdstringrequired -
versionstringrequired -
timelinesToInstallobjectrequired -
columnsobjectnullable -
The Timeline's columns
-
creatednumbernullable -
The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the Timeline.
-
dataProvidersobjectnullable -
Object containing query clauses
-
dataViewIdstringnullable -
ID of the Timeline's Data View
-
dateRangeobjectnullable -
The Timeline's search period.
-
descriptionstringnullable -
The Timeline's description
-
eqlOptionsobjectnullable -
EQL query that is used in the correlation tab
-
eventCategoryFieldstringnullable -
querystringnullable -
sizestring | numbernullable -
tiebreakerFieldstringnullable -
timestampFieldstringnullable -
eventTypestringnullable deprecated -
Event types displayed in the Timeline
-
excludedRowRendererIds -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
favoriteobjectnullable -
favoriteDatenumbernullable -
fullNamestringnullable -
userNamestringnullable -
filtersobjectnullable -
A list of filters that should be applied to the query
-
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
kqlQuery -
KQL bar query.
-
filterQueryobjectnullable -
kueryobjectnullable -
expressionstringnullable -
kindstringnullable -
serializedQuerystringnullable -
savedQueryIdstringnullable -
The ID of the saved query that might be used in the Query tab
-
savedSearchIdstringnullable -
The ID of the saved search that is used in the ES|QL tab
-
sort -
columnIdstringnullable -
columnTypestringnullable -
sortDirectionstringnullable -
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
titlestringnullable -
The Timeline's title.
-
updatednumbernullable -
The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the Timeline
-
eventNotesobjectrequired nullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
globalNotesobjectrequired nullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
pinnedEventIdsstringrequired nullable -
savedObjectIdstringrequired nullable -
versionstringrequired nullable -
timelinesToUpdateobjectrequired
Responses
Indicates the installation of prepackaged Timelines was successful.
-
errorsobject -
The list of failed Timeline imports
-
errorobject -
The error containing the reason why the timeline could not be imported
-
messagestring -
The reason why the timeline could not be imported
-
status_codenumber -
The HTTP status code of the error
-
idstring -
The ID of the timeline that failed to import
-
successboolean -
Indicates whether any of the Timelines were successfully imports
-
success_countnumber -
The amount of successfully imported/updated Timelines
-
timelines_installednumber -
The amount of successfully installed Timelines
-
timelines_updatednumber -
The amount of successfully updated Timelines
Indicates the installation of prepackaged Timelines was unsuccessful.
-
bodystring -
statusCodenumber