Sign in
Security Timeline API

Get Timelines or Timeline templates

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timelines</span></div>

Refer to Spaces for more information.

Get a list of all saved Timelines or Timeline templates.

get/api/timelines

Query parameters

only_user_favorite'true' | 'false' nullable

If true, only Timelines that the current user has marked as favorite are returned.

timeline_type'default' | 'template'

The type of Timeline.

Restrict results to default investigation timelines or template timeline templates.

sort_field'title' | 'description' | 'updated' | 'created'

The field to sort the timelines by.

Field used to sort the list (title, description, updated, or created).

sort_order'asc' | 'desc'

Whether to sort the results ascending or descending

page_sizestring nullable

How many results should returned at once

page_indexstring nullable

How many pages should be skipped

searchstring nullable

Allows to search for timelines by their title

status'active' | 'draft' | 'immutable'

The status of the Timeline.

Filter by timeline lifecycle state (active, draft, or immutable).

Response

Indicates a successful call.

customTemplateTimelineCountnumber

The amount of custom Timeline templates in the results

defaultTimelineCountnumber

The amount of default type Timelines in the results

elasticTemplateTimelineCountnumber

The amount of Elastic's Timeline templates in the results

favoriteCountnumber

The amount of favorited Timelines

templateTimelineCountnumber

The amount of Timeline templates in the results

totalCountnumber required

The total amount of results

Example response

{
  "customTemplateTimelineCount": 2,
  "defaultTimelineCount": 90,
  "elasticTemplateTimelineCount": 8,
  "favoriteCount": 5,
  "templateTimelineCount": 10,
  "timeline": [
    {
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        }
      ],
      "created": 1587468588922,
      "createdBy": "casetester",
      "dataProviders": [
        {
          "enabled": true,
          "excluded": false,
          "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
          "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
          "queryMatch": {
            "field": "_id,",
            "operator": ":",
            "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
          }
        }
      ],
      "dataViewId": "security-solution-default",
      "dateRange": {
        "end": 1587456479201,
        "start": 1587370079200
      },
      "description": "Investigating exposure of CVE XYZ",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
        "size": 100,
        "timestampField": "@timestamp"
      },
      "eventType": "all",
      "favorite": [
        {
          "favoriteDate": 1741337636741,
          "userName": "elastic"
        }
      ],
      "filters": [
        {
          "meta": {
            "alias": "Custom filter name",
            "disabled": false,
            "index": ".alerts-security.alerts-default,logs-*",
            "key": "@timestamp",
            "negate": "false,",
            "type": "exists",
            "value": "exists"
          },
          "query": "{\"exists\":{\"field\":\"@timestamp\"}}"
        }
      ],
      "indexNames": [
        ".logs*"
      ],
      "kqlMode": "search",
      "kqlQuery": {
        "filterQuery": null,
        "kuery": {
          "expression": "_id : *",
          "kind": "kuery"
        },
        "serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
      },
      "savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
      "savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
      "sort": {
        "columnId": "@timestamp",
        "sortDirection": "desc"
      },
      "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
      "templateTimelineVersion": 12,
      "title": "CVE XYZ investigation",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "version": "WzE0LDFd",
      "eventIdToNoteIds": [
        {
          "created": 1587468588922,
          "createdBy": "casetester",
          "updated": 1741344876825,
          "updatedBy": "casetester",
          "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
          "note": "This is an example text",
          "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
          "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
          "version": "WzQ2LDFd"
        }
      ],
      "noteIds": [
        "709f99c6-89b6-4953-9160-35945c8e174e"
      ],
      "notes": [
        {
          "created": 1587468588922,
          "createdBy": "casetester",
          "updated": 1741344876825,
          "updatedBy": "casetester",
          "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
          "note": "This is an example text",
          "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
          "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
          "version": "WzQ2LDFd"
        }
      ],
      "pinnedEventIds": [
        "983f99c6-89b6-4953-9160-35945c8a194f"
      ],
      "pinnedEventsSaveObject": [
        {
          "created": 1587468588922,
          "createdBy": "casetester",
          "updated": 1741344876825,
          "updatedBy": "casetester",
          "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
          "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
          "pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
          "version": "WzQ2LDFe"
        }
      ]
    }
  ],
  "totalCount": 100
}

Changes

No changes recorded. 20 of the 176 revisions have no diff computed, so they could not be searched.