Get an existing saved Timeline or Timeline template
- Base URL
-
https://{kibana_url}
- GET /api/timeline/resolve
- GET /s/{space_id}/api/timeline/resolve
Refer to Spaces for more information.
Authentication
Authorization: <value>These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey
Authorization: Basic <credentials>Responses
The (template) Timeline has been found
One of:
-
dataobjectrequired -
timelineobjectrequired -
excludedRowRendererIdsenum[]nullable -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
indexNamesstring[]nullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null.
400
The request is missing parameters
404
The (template) Timeline was not found