Query parameters

• template_timeline_id string

  The ID of the template timeline to retrieve

• id string

  The ID of the timeline to retrieve

Responses

• 200 application/json; Elastic-Api-Version=2023-10-31

  Indicates that the (template) timeline was found and returned.

  One of:

  object-1 object object-2 object

  Hide attribute Show attribute

  • data object Required

    Additional properties are allowed.

    Hide data attribute Show data attribute object

    • getOneTimeline object Required

      Additional properties are allowed.

      Hide getOneTimeline attributes Show getOneTimeline attributes object

      • columns array[object] | null
        Hide columns attributes Show columns attributes object

        • aggregatable boolean | null
        • category string | null
        • columnHeaderType string | null
        • description string | null
        • example string | null
        • id string | null
        • indexes array[string] | null
        • name string | null
        • placeholder string | null
        • searchable boolean | null
        • type string | null
      • created number | null
      • createdBy string | null
      • dataProviders array[object] | null
        Hide dataProviders attributes Show dataProviders attributes object

        • and array[object] | null
          Hide and attributes Show and attributes object

          • enabled boolean | null
          • excluded boolean | null
          • id string | null
          • kqlQuery string | null
          • name string | null
          • queryMatch object | null

            Additional properties are allowed.

            Hide queryMatch attributes Show queryMatch attributes object | null

            • displayField string | null
            • displayValue string | null
            • field string | null
            • operator string | null

            • value string | null | array[string]

              One of:

              string-1 string | null array-2 array[string] | null
          • type string | null

            The type of data provider to create. Valid values are default and template.

            Values are default or template.

        • enabled boolean | null
        • excluded boolean | null
        • id string | null
        • kqlQuery string | null
        • name string | null
        • queryMatch object | null

          Additional properties are allowed.

          Hide queryMatch attributes Show queryMatch attributes object | null

          • displayField string | null
          • displayValue string | null
          • field string | null
          • operator string | null

          • value string | null | array[string]

            One of:

            string-1 string | null array-2 array[string] | null
        • type string | null

          The type of data provider to create. Valid values are default and template.

          Values are default or template.

      • dataViewId string | null
      • dateRange object | null

        Additional properties are allowed.

        Hide dateRange attributes Show dateRange attributes object | null

        • end string | null | number

          One of:

          string-1 string | null number-2 number | null

        • start string | null | number

          One of:

          string-1 string | null number-2 number | null
      • description string | null
      • eqlOptions object | null

        Additional properties are allowed.

        Hide eqlOptions attributes Show eqlOptions attributes object | null

        • eventCategoryField string | null
        • query string | null

        • size string | null | number

          One of:

          string-1 string | null number-2 number | null
        • tiebreakerField string | null
        • timestampField string | null
      • eventType string | null
      • excludedRowRendererIds array[string] | null

        Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

      • favorite array[object] | null
        Hide favorite attributes Show favorite attributes object

        • favoriteDate number | null
        • fullName string | null
        • userName string | null
      • filters array[object] | null
        Hide filters attributes Show filters attributes object

        • exists string | null
        • match_all string | null
        • meta object | null

          Additional properties are allowed.

          Hide meta attributes Show meta attributes object | null

          • alias string | null
          • controlledBy string | null
          • disabled boolean | null
          • field string | null
          • formattedValue string | null
          • index string | null
          • key string | null
          • negate boolean | null
          • params string | null
          • type string | null
          • value string | null
        • missing string | null
        • query string | null
        • range string | null
        • script string | null
      • indexNames array[string] | null
      • kqlMode string | null
      • kqlQuery object | null

        Additional properties are allowed.

        Hide kqlQuery attribute Show kqlQuery attribute object | null

        • filterQuery object | null

          Additional properties are allowed.

          Hide filterQuery attributes Show filterQuery attributes object | null

          • kuery object | null

            Additional properties are allowed.

            Hide kuery attributes Show kuery attributes object | null

            • expression string | null
            • kind string | null
          • serializedQuery string | null
      • savedQueryId string | null
      • savedSearchId string | null

      • sort object | null | array[object]

        One of:

        Security_Timeline_API_SortObject object | null array-2 array[object] | null

        Hide attributes Show attributes

        • columnId string | null
        • columnType string | null
        • sortDirection string | null

        Hide attributes Show attributes object

        • columnId string | null
        • columnType string | null
        • sortDirection string | null
      • status string | null

        Values are active, draft, or immutable.

      • templateTimelineId string | null
      • templateTimelineVersion number | null
      • timelineType string | null

        The type of timeline to create. Valid values are default and template.

        Values are default or template.

      • title string | null
      • updated number | null
      • updatedBy string | null
      • savedObjectId string Required
      • version string Required
      • eventIdToNoteIds array[object] | null
        Hide eventIdToNoteIds attributes Show eventIdToNoteIds attributes object

        • created number | null
        • createdBy string | null
        • eventId string | null
        • note string | null
        • timelineId string Required
        • updated number | null
        • updatedBy string | null
        • noteId string Required
        • version string Required
      • noteIds array[string] | null
      • notes array[object] | null
        Hide notes attributes Show notes attributes object

        • created number | null
        • createdBy string | null
        • eventId string | null
        • note string | null
        • timelineId string Required
        • updated number | null
        • updatedBy string | null
        • noteId string Required
        • version string Required
      • pinnedEventIds array[string] | null
      • pinnedEventsSaveObject array[object] | null
        Hide pinnedEventsSaveObject attributes Show pinnedEventsSaveObject attributes object

        • created number | null
        • createdBy string | null
        • eventId string Required
        • timelineId string Required
        • updated number | null
        • updatedBy string | null
        • pinnedEventId string Required
        • version string Required

  Additional properties are NOT allowed.