Query parameters

• only_user_favorite string | null

  If true, only timelines that are marked as favorites by the user are returned.

  Values are true or false.

• timeline_type string | null

  The type of timeline to create. Valid values are default and template.

  Values are default or template.

• sort_field string

  The field to sort the timelines by.

  Values are title, description, updated, or created.

• sort_order string

  Values are asc or desc.

• page_size string | null
• page_index string | null
• search string | null
• status string | null

  The status of the timeline. Valid values are active, draft, and immutable.

  Values are active, draft, or immutable.

Responses

• 200 application/json; Elastic-Api-Version=2023-10-31

  Indicates that the (template) timelines were found and returned.

  Hide response attribute Show response attribute object

  • data object Required
    Hide data attributes Show data attributes object

    • customTemplateTimelineCount number Required
    • defaultTimelineCount number Required
    • elasticTemplateTimelineCount number Required
    • favoriteCount number Required
    • templateTimelineCount number Required
    • timelines array[object] Required
      Hide timelines attributes Show timelines attributes object | null

      • columns array[object] | null
        Hide columns attributes Show columns attributes object

        • aggregatable boolean
        • category string
        • columnHeaderType string
        • description string

        • example string | number

          One of:

          string-1 string number-2 number
        • id string
        • indexes array[string]
        • name string
        • placeholder string
        • searchable boolean
        • type string
      • created number | null
      • createdBy string | null
      • dataProviders array[object] | null
        Hide dataProviders attributes Show dataProviders attributes object

        • and array[object] | null
          Hide and attributes Show and attributes object

          • enabled boolean | null
          • excluded boolean | null
          • id string | null
          • kqlQuery string | null
          • name string | null
          • queryMatch object
            Hide queryMatch attributes Show queryMatch attributes object

            • displayField string | null
            • displayValue string | null
            • field string | null
            • operator string | null
            • value string | null
        • enabled boolean | null
        • excluded boolean | null
        • id string | null
        • kqlQuery string | null
        • name string | null
        • queryMatch object
          Hide queryMatch attributes Show queryMatch attributes object

          • displayField string | null
          • displayValue string | null
          • field string | null
          • operator string | null
          • value string | null
        • type string | null

          The type of data provider to create. Valid values are default and template.

          Values are default or template.

      • dataViewId string | null
      • dateRange object | null
        Hide dateRange attributes Show dateRange attributes object | null

        • end string | number

          One of:

          string-1 string number-2 number

        • start string | number

          One of:

          string-1 string number-2 number
      • description string | null
      • eqlOptions object | null
        Hide eqlOptions attributes Show eqlOptions attributes object | null

        • eventCategoryField string | null
        • query string | null

        • size string | null | number

          One of:

          string-1 string | null number-2 number | null
        • tiebreakerField string | null
        • timestampField string | null
      • eventType string | null
      • excludedRowRendererIds array[string] | null

        Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

      • favorite array[object] | null
        Hide favorite attributes Show favorite attributes object

        • favoriteDate number | null
        • fullName string | null
        • userName string | null
      • filters array[object] | null
        Hide filters attributes Show filters attributes object

        • exists boolean
        • match_all string
        • meta object
          Hide meta attributes Show meta attributes object

          • alias string
          • controlledBy string
          • disabled boolean
          • field string
          • formattedValue string
          • index string
          • key string
          • negate boolean
          • params string
          • type string
          • value string
        • missing string
        • query string
        • range string
        • script string
      • indexNames array[string] | null
      • kqlMode string | null
      • kqlQuery object | null
        Hide kqlQuery attribute Show kqlQuery attribute object | null

        • filterQuery object | null
          Hide filterQuery attributes Show filterQuery attributes object | null

          • kuery object | null
            Hide kuery attributes Show kuery attributes object | null

            • expression string | null
            • kind string | null
          • serializedQuery string | null
      • savedQueryId string | null
      • savedSearchId string | null

      • sort object | null | array[object]

        One of:

        Security_Solution_Timeline_API_SortObject object | null array-2 array[object] | null

        Hide attributes Show attributes

        • columnId string | null
        • columnType string | null
        • sortDirection string | null

        Hide attributes Show attributes object

        • columnId string | null
        • columnType string | null
        • sortDirection string | null
      • status string | null

        Values are active, draft, or immutable.

      • templateTimelineId string | null
      • templateTimelineVersion number | null
      • timelineType string | null

        The type of timeline to create. Valid values are default and template.

        Values are default or template.

      • title string | null
      • updated number | null
      • updatedBy string | null
      • eventIdToNoteIds array[object]
        Hide eventIdToNoteIds attributes Show eventIdToNoteIds attributes object

        • created number | null
        • createdBy string | null
        • eventId string | null
        • note string | null
        • timelineId string | null Required
        • updated number | null
        • updatedBy string | null
        • noteId string
        • version string
      • noteIds array[string]
      • notes array[object]
        Hide notes attributes Show notes attributes object

        • created number | null
        • createdBy string | null
        • eventId string | null
        • note string | null
        • timelineId string | null Required
        • updated number | null
        • updatedBy string | null
        • noteId string
        • version string
      • pinnedEventIds array[string]
      • pinnedEventsSaveObject array[object]
        Hide pinnedEventsSaveObject attributes Show pinnedEventsSaveObject attributes object

        • created number | null
        • createdBy string | null
        • eventId string Required
        • pinnedEventId string Required
        • timelineId string Required
        • updated number | null
        • updatedBy string | null
        • version string Required
      • savedObjectId string Required
      • version string Required
    • totalCount number Required
• 400 application:json; Elastic-Api-Version=2023-10-31

  Bad request. The user supplied invalid data.

  Hide response attributes Show response attributes object

  • body string
  • statusCode number