Install prepackaged Timelines

Base URL
https://{kibana_url}
  • POST /api/timeline/_prepackaged
  • POST /s/{space_id}/api/timeline/_prepackaged
Auth

Install or update prepackaged Timelines.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

The Timelines to install or update.

prepackagedTimelines object[] required
columns object[] nullable

The Timeline's columns

aggregatable boolean nullable
category string nullable
columnHeaderType string nullable
description string nullable
example string nullable
id string nullable
indexes string[] nullable
name string nullable
placeholder string nullable
searchable boolean nullable
type string nullable
created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataProviders object[] nullable

Object containing query clauses

and object[] nullable
enabled boolean nullable
excluded boolean nullable
id string nullable
kqlQuery string nullable
name string nullable
queryMatch object
displayField string nullable
displayValue string nullable
field string nullable
operator string nullable
value union string | string[] nullable
type enum

The type of data provider.

Values: default template
enabled boolean nullable
excluded boolean nullable
id string nullable
kqlQuery string nullable
name string nullable
queryMatch object
displayField string nullable
displayValue string nullable
field string nullable
operator string nullable
value union string | string[] nullable
type enum

The type of data provider.

Values: default template
dataViewId string nullable

ID of the Timeline's Data View

dateRange object nullable

The Timeline's search period.

end union string | number nullable
start union string | number nullable
description string nullable

The Timeline's description

eqlOptions object nullable

EQL query that is used in the correlation tab

eventCategoryField string nullable
query string nullable
size union string | number nullable
tiebreakerField string nullable
timestampField string nullable
eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
favorite object[] nullable
favoriteDate number nullable
fullName string nullable
userName string nullable
filters object[] nullable

A list of filters that should be applied to the query

exists string nullable
match_all string nullable
meta object nullable
alias string nullable
controlledBy string nullable
disabled boolean nullable
field string nullable
formattedValue string nullable
index string nullable
key string nullable
negate boolean nullable
params string nullable
type string nullable
value string nullable
missing string nullable
query string nullable
range string nullable
script string nullable
indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

  • filter: filters query results
  • search: displays additional search results
kqlQuery object

KQL bar query.

filterQuery object nullable
kuery object nullable
expression string nullable
kind string nullable
serializedQuery string nullable
savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

sort union oneOf
object or object[]
columnId string nullable
columnType string nullable
sortDirection string nullable
status enum

The status of the Timeline.

Values: active draft immutable
templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template
title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

eventIdToNoteIds object[] nullable
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

The _id of the associated event for this note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline that this note is associated with

noteId string required

The savedObjectId of the note

version string required

The version of the note

noteIds string[] nullable
notes object[] nullable
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

The _id of the associated event for this note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline that this note is associated with

noteId string required

The savedObjectId of the note

version string required

The version of the note

pinnedEventIds string[] nullable
pinnedEventsSaveObject object[] nullable
created number nullable

The time the pinned event was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the pinned event.

updated number nullable

The last time the pinned event was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the pinned event

eventId string required

The _id of the associated event for this pinned event.

timelineId string required

The savedObjectId of the timeline that this pinned event is associated with

pinnedEventId string required

The savedObjectId of this pinned event

version string required

The version of this pinned event

savedObjectId string required
version string required
timelinesToInstall object[] required
columns object[] nullable

The Timeline's columns

Same fields as columns in prepackagedTimelines
created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataProviders object[] nullable

Object containing query clauses

Same fields as dataProviders in prepackagedTimelines
dataViewId string nullable

ID of the Timeline's Data View

dateRange object nullable

The Timeline's search period.

end union string | number nullable
start union string | number nullable
description string nullable

The Timeline's description

eqlOptions object nullable

EQL query that is used in the correlation tab

eventCategoryField string nullable
query string nullable
size union string | number nullable
tiebreakerField string nullable
timestampField string nullable
eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
favorite object[] nullable
favoriteDate number nullable
fullName string nullable
userName string nullable
filters object[] nullable

A list of filters that should be applied to the query

Same fields as filters in prepackagedTimelines
indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

  • filter: filters query results
  • search: displays additional search results
kqlQuery object

KQL bar query.

filterQuery object nullable
kuery object nullable
expression string nullable
kind string nullable
serializedQuery string nullable
savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

sort union oneOf
object or object[]
columnId string nullable
columnType string nullable
sortDirection string nullable
status enum

The status of the Timeline.

Values: active draft immutable
templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template
title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

eventNotes object[] required nullable
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

The _id of the associated event for this note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline that this note is associated with

globalNotes object[] required nullable
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

The _id of the associated event for this note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline that this note is associated with

pinnedEventIds string[] required nullable
savedObjectId string required nullable
version string required nullable
timelinesToUpdate object[] required
Same fields as timelinesToInstall

Responses

Indicates the installation of prepackaged Timelines was successful.

application/json
errors object[]

The list of failed Timeline imports

error object

The error containing the reason why the timeline could not be imported

message string

The reason why the timeline could not be imported

status_code number

The HTTP status code of the error

id string

The ID of the timeline that failed to import

success boolean

Indicates whether any of the Timelines were successfully imports

success_count number

The amount of successfully imported/updated Timelines

timelines_installed number

The amount of successfully installed Timelines

timelines_updated number

The amount of successfully updated Timelines

Indicates the installation of prepackaged Timelines was unsuccessful.

application/json
body string
statusCode number
Base URL
https://{kibana_url}