Responses

• 200 application/json; Elastic-Api-Version=2023-10-31

  Indicates that the draft timeline was successfully created. In the event the user already has a draft timeline, the existing draft timeline is cleared and returned.

  Hide response attribute Show response attribute object

  • data object Required
    Hide data attribute Show data attribute object

    • persistTimeline object Required
      Hide persistTimeline attribute Show persistTimeline attribute object

      • timeline object | null Required
        Hide timeline attributes Show timeline attributes object | null

        • columns array[object] | null
          Hide columns attributes Show columns attributes object

          • aggregatable boolean
          • category string
          • columnHeaderType string
          • description string

          • example string | number

            One of:

            string-1 string number-2 number
          • id string
          • indexes array[string]
          • name string
          • placeholder string
          • searchable boolean
          • type string
        • created number | null
        • createdBy string | null
        • dataProviders array[object] | null
          Hide dataProviders attributes Show dataProviders attributes object

          • and array[object] | null
            Hide and attributes Show and attributes object

            • enabled boolean | null
            • excluded boolean | null
            • id string | null
            • kqlQuery string | null
            • name string | null
            • queryMatch object
              Hide queryMatch attributes Show queryMatch attributes object

              • displayField string | null
              • displayValue string | null
              • field string | null
              • operator string | null
              • value string | null
          • enabled boolean | null
          • excluded boolean | null
          • id string | null
          • kqlQuery string | null
          • name string | null
          • queryMatch object
            Hide queryMatch attributes Show queryMatch attributes object

            • displayField string | null
            • displayValue string | null
            • field string | null
            • operator string | null
            • value string | null
          • type string | null

            The type of data provider to create. Valid values are default and template.

            Values are default or template.

        • dataViewId string | null
        • dateRange object | null
          Hide dateRange attributes Show dateRange attributes object | null

          • end string | number

            One of:

            string-1 string number-2 number

          • start string | number

            One of:

            string-1 string number-2 number
        • description string | null
        • eqlOptions object | null
          Hide eqlOptions attributes Show eqlOptions attributes object | null

          • eventCategoryField string | null
          • query string | null

          • size string | null | number

            One of:

            string-1 string | null number-2 number | null
          • tiebreakerField string | null
          • timestampField string | null
        • eventType string | null
        • excludedRowRendererIds array[string] | null

          Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

        • favorite array[object] | null
          Hide favorite attributes Show favorite attributes object

          • favoriteDate number | null
          • fullName string | null
          • userName string | null
        • filters array[object] | null
          Hide filters attributes Show filters attributes object

          • exists boolean
          • match_all string
          • meta object
            Hide meta attributes Show meta attributes object

            • alias string
            • controlledBy string
            • disabled boolean
            • field string
            • formattedValue string
            • index string
            • key string
            • negate boolean
            • params string
            • type string
            • value string
          • missing string
          • query string
          • range string
          • script string
        • indexNames array[string] | null
        • kqlMode string | null
        • kqlQuery object | null
          Hide kqlQuery attribute Show kqlQuery attribute object | null

          • filterQuery object | null
            Hide filterQuery attributes Show filterQuery attributes object | null

            • kuery object | null
              Hide kuery attributes Show kuery attributes object | null

              • expression string | null
              • kind string | null
            • serializedQuery string | null
        • savedQueryId string | null
        • savedSearchId string | null

        • sort object | null | array[object]

          One of:

          Security_Solution_Timeline_API_SortObject object | null array-2 array[object] | null

          Hide attributes Show attributes

          • columnId string | null
          • columnType string | null
          • sortDirection string | null

          Hide attributes Show attributes object

          • columnId string | null
          • columnType string | null
          • sortDirection string | null
        • status string | null

          Values are active, draft, or immutable.

        • templateTimelineId string | null
        • templateTimelineVersion number | null
        • timelineType string | null

          The type of timeline to create. Valid values are default and template.

          Values are default or template.

        • title string | null
        • updated number | null
        • updatedBy string | null
        • eventIdToNoteIds array[object]
          Hide eventIdToNoteIds attributes Show eventIdToNoteIds attributes object

          • created number | null
          • createdBy string | null
          • eventId string | null
          • note string | null
          • timelineId string | null Required
          • updated number | null
          • updatedBy string | null
          • noteId string
          • version string
        • noteIds array[string]
        • notes array[object]
          Hide notes attributes Show notes attributes object

          • created number | null
          • createdBy string | null
          • eventId string | null
          • note string | null
          • timelineId string | null Required
          • updated number | null
          • updatedBy string | null
          • noteId string
          • version string
        • pinnedEventIds array[string]
        • pinnedEventsSaveObject array[object]
          Hide pinnedEventsSaveObject attributes Show pinnedEventsSaveObject attributes object

          • created number | null
          • createdBy string | null
          • eventId string Required
          • pinnedEventId string Required
          • timelineId string Required
          • updated number | null
          • updatedBy string | null
          • version string Required
        • savedObjectId string Required
        • version string Required
• 403 application:json; Elastic-Api-Version=2023-10-31

  Indicates that the user does not have the required permissions to create a draft timeline.

  Hide response attributes Show response attributes object

  • message string
  • status_code number
• 409 application:json; Elastic-Api-Version=2023-10-31

  Indicates that there is already a draft timeline with the given timelineId.

  Hide response attributes Show response attributes object

  • message string
  • status_code number