Get draft Timeline or Timeline template details
- Base URL
-
https://{kibana_url}
- GET /api/timeline/_draft
- GET /s/{space_id}/api/timeline/_draft
Refer to Spaces for more information.
Get the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned.
Responses
Indicates that the draft Timeline was successfully retrieved.
-
dataobjectrequired -
persistTimelineobjectrequired -
timelineobjectrequired -
excludedRowRendererIdsnullable -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
pinnedEventIdsstringnullable -
A list of all the ids of pinned events that are associated to this Timeline.
If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.