Body Required

• prepackagedTimelines array[object] Required
  Hide prepackagedTimelines attributes Show prepackagedTimelines attributes object

  • columns array[object] | null
    Hide columns attributes Show columns attributes object

    • aggregatable boolean
    • category string
    • columnHeaderType string
    • description string

    • example string | number

      One of:

      string-1 string number-2 number
    • id string
    • indexes array[string]
    • name string
    • placeholder string
    • searchable boolean
    • type string
  • created number | null
  • createdBy string | null
  • dataProviders array[object] | null
    Hide dataProviders attributes Show dataProviders attributes object

    • and array[object] | null
      Hide and attributes Show and attributes object

      • enabled boolean | null
      • excluded boolean | null
      • id string | null
      • kqlQuery string | null
      • name string | null
      • queryMatch object
        Hide queryMatch attributes Show queryMatch attributes object

        • displayField string | null
        • displayValue string | null
        • field string | null
        • operator string | null
        • value string | null
    • enabled boolean | null
    • excluded boolean | null
    • id string | null
    • kqlQuery string | null
    • name string | null
    • queryMatch object
      Hide queryMatch attributes Show queryMatch attributes object

      • displayField string | null
      • displayValue string | null
      • field string | null
      • operator string | null
      • value string | null
    • type string | null

      The type of data provider to create. Valid values are default and template.

      Values are default or template.

  • dataViewId string | null
  • dateRange object | null
    Hide dateRange attributes Show dateRange attributes object | null

    • end string | number

      One of:

      string-1 string number-2 number

    • start string | number

      One of:

      string-1 string number-2 number
  • description string | null
  • eqlOptions object | null
    Hide eqlOptions attributes Show eqlOptions attributes object | null

    • eventCategoryField string | null
    • query string | null

    • size string | null | number

      One of:

      string-1 string | null number-2 number | null
    • tiebreakerField string | null
    • timestampField string | null
  • eventType string | null
  • excludedRowRendererIds array[string] | null

    Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

  • favorite array[object] | null
    Hide favorite attributes Show favorite attributes object

    • favoriteDate number | null
    • fullName string | null
    • userName string | null
  • filters array[object] | null
    Hide filters attributes Show filters attributes object

    • exists boolean
    • match_all string
    • meta object
      Hide meta attributes Show meta attributes object

      • alias string
      • controlledBy string
      • disabled boolean
      • field string
      • formattedValue string
      • index string
      • key string
      • negate boolean
      • params string
      • type string
      • value string
    • missing string
    • query string
    • range string
    • script string
  • indexNames array[string] | null
  • kqlMode string | null
  • kqlQuery object | null
    Hide kqlQuery attribute Show kqlQuery attribute object | null

    • filterQuery object | null
      Hide filterQuery attributes Show filterQuery attributes object | null

      • kuery object | null
        Hide kuery attributes Show kuery attributes object | null

        • expression string | null
        • kind string | null
      • serializedQuery string | null
  • savedQueryId string | null
  • savedSearchId string | null

  • sort object | null | array[object]

    One of:

    Security_Solution_Timeline_API_SortObject object | null array-2 array[object] | null

    Hide attributes Show attributes

    • columnId string | null
    • columnType string | null
    • sortDirection string | null

    Hide attributes Show attributes object

    • columnId string | null
    • columnType string | null
    • sortDirection string | null
  • status string | null

    Values are active, draft, or immutable.

  • templateTimelineId string | null
  • templateTimelineVersion number | null
  • timelineType string | null

    The type of timeline to create. Valid values are default and template.

    Values are default or template.

  • title string | null
  • updated number | null
  • updatedBy string | null
• timelinesToInstall array[object] Required
  Hide timelinesToInstall attributes Show timelinesToInstall attributes object | null

  • columns array[object] | null
    Hide columns attributes Show columns attributes object

    • aggregatable boolean
    • category string
    • columnHeaderType string
    • description string

    • example string | number

      One of:

      string-1 string number-2 number
    • id string
    • indexes array[string]
    • name string
    • placeholder string
    • searchable boolean
    • type string
  • created number | null
  • createdBy string | null
  • dataProviders array[object] | null
    Hide dataProviders attributes Show dataProviders attributes object

    • and array[object] | null
      Hide and attributes Show and attributes object

      • enabled boolean | null
      • excluded boolean | null
      • id string | null
      • kqlQuery string | null
      • name string | null
      • queryMatch object
        Hide queryMatch attributes Show queryMatch attributes object

        • displayField string | null
        • displayValue string | null
        • field string | null
        • operator string | null
        • value string | null
    • enabled boolean | null
    • excluded boolean | null
    • id string | null
    • kqlQuery string | null
    • name string | null
    • queryMatch object
      Hide queryMatch attributes Show queryMatch attributes object

      • displayField string | null
      • displayValue string | null
      • field string | null
      • operator string | null
      • value string | null
    • type string | null

      The type of data provider to create. Valid values are default and template.

      Values are default or template.

  • dataViewId string | null
  • dateRange object | null
    Hide dateRange attributes Show dateRange attributes object | null

    • end string | number

      One of:

      string-1 string number-2 number

    • start string | number

      One of:

      string-1 string number-2 number
  • description string | null
  • eqlOptions object | null
    Hide eqlOptions attributes Show eqlOptions attributes object | null

    • eventCategoryField string | null
    • query string | null

    • size string | null | number

      One of:

      string-1 string | null number-2 number | null
    • tiebreakerField string | null
    • timestampField string | null
  • eventType string | null
  • excludedRowRendererIds array[string] | null

    Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

  • favorite array[object] | null
    Hide favorite attributes Show favorite attributes object

    • favoriteDate number | null
    • fullName string | null
    • userName string | null
  • filters array[object] | null
    Hide filters attributes Show filters attributes object

    • exists boolean
    • match_all string
    • meta object
      Hide meta attributes Show meta attributes object

      • alias string
      • controlledBy string
      • disabled boolean
      • field string
      • formattedValue string
      • index string
      • key string
      • negate boolean
      • params string
      • type string
      • value string
    • missing string
    • query string
    • range string
    • script string
  • indexNames array[string] | null
  • kqlMode string | null
  • kqlQuery object | null
    Hide kqlQuery attribute Show kqlQuery attribute object | null

    • filterQuery object | null
      Hide filterQuery attributes Show filterQuery attributes object | null

      • kuery object | null
        Hide kuery attributes Show kuery attributes object | null

        • expression string | null
        • kind string | null
      • serializedQuery string | null
  • savedQueryId string | null
  • savedSearchId string | null

  • sort object | null | array[object]

    One of:

    Security_Solution_Timeline_API_SortObject object | null array-2 array[object] | null

    Hide attributes Show attributes

    • columnId string | null
    • columnType string | null
    • sortDirection string | null

    Hide attributes Show attributes object

    • columnId string | null
    • columnType string | null
    • sortDirection string | null
  • status string | null

    Values are active, draft, or immutable.

  • templateTimelineId string | null
  • templateTimelineVersion number | null
  • timelineType string | null

    The type of timeline to create. Valid values are default and template.

    Values are default or template.

  • title string | null
  • updated number | null
  • updatedBy string | null
  • eventNotes array[object] | null
    Hide eventNotes attributes Show eventNotes attributes object

    • created number | null
    • createdBy string | null
    • eventId string | null
    • note string | null
    • timelineId string | null Required
    • updated number | null
    • updatedBy string | null
  • globalNotes array[object] | null
    Hide globalNotes attributes Show globalNotes attributes object

    • created number | null
    • createdBy string | null
    • eventId string | null
    • note string | null
    • timelineId string | null Required
    • updated number | null
    • updatedBy string | null
  • pinnedEventIds array[string] | null
  • savedObjectId string | null
  • version string | null
• timelinesToUpdate array[object] Required
  Hide timelinesToUpdate attributes Show timelinesToUpdate attributes object | null

  • columns array[object] | null
    Hide columns attributes Show columns attributes object

    • aggregatable boolean
    • category string
    • columnHeaderType string
    • description string

    • example string | number

      One of:

      string-1 string number-2 number
    • id string
    • indexes array[string]
    • name string
    • placeholder string
    • searchable boolean
    • type string
  • created number | null
  • createdBy string | null
  • dataProviders array[object] | null
    Hide dataProviders attributes Show dataProviders attributes object

    • and array[object] | null
      Hide and attributes Show and attributes object

      • enabled boolean | null
      • excluded boolean | null
      • id string | null
      • kqlQuery string | null
      • name string | null
      • queryMatch object
        Hide queryMatch attributes Show queryMatch attributes object

        • displayField string | null
        • displayValue string | null
        • field string | null
        • operator string | null
        • value string | null
    • enabled boolean | null
    • excluded boolean | null
    • id string | null
    • kqlQuery string | null
    • name string | null
    • queryMatch object
      Hide queryMatch attributes Show queryMatch attributes object

      • displayField string | null
      • displayValue string | null
      • field string | null
      • operator string | null
      • value string | null
    • type string | null

      The type of data provider to create. Valid values are default and template.

      Values are default or template.

  • dataViewId string | null
  • dateRange object | null
    Hide dateRange attributes Show dateRange attributes object | null

    • end string | number

      One of:

      string-1 string number-2 number

    • start string | number

      One of:

      string-1 string number-2 number
  • description string | null
  • eqlOptions object | null
    Hide eqlOptions attributes Show eqlOptions attributes object | null

    • eventCategoryField string | null
    • query string | null

    • size string | null | number

      One of:

      string-1 string | null number-2 number | null
    • tiebreakerField string | null
    • timestampField string | null
  • eventType string | null
  • excludedRowRendererIds array[string] | null

    Values are alert, alerts, auditd, auditd_file, library, netflow, plain, registry, suricata, system, system_dns, system_endgame_process, system_file, system_fim, system_security_event, system_socket, threat_match, or zeek.

  • favorite array[object] | null
    Hide favorite attributes Show favorite attributes object

    • favoriteDate number | null
    • fullName string | null
    • userName string | null
  • filters array[object] | null
    Hide filters attributes Show filters attributes object

    • exists boolean
    • match_all string
    • meta object
      Hide meta attributes Show meta attributes object

      • alias string
      • controlledBy string
      • disabled boolean
      • field string
      • formattedValue string
      • index string
      • key string
      • negate boolean
      • params string
      • type string
      • value string
    • missing string
    • query string
    • range string
    • script string
  • indexNames array[string] | null
  • kqlMode string | null
  • kqlQuery object | null
    Hide kqlQuery attribute Show kqlQuery attribute object | null

    • filterQuery object | null
      Hide filterQuery attributes Show filterQuery attributes object | null

      • kuery object | null
        Hide kuery attributes Show kuery attributes object | null

        • expression string | null
        • kind string | null
      • serializedQuery string | null
  • savedQueryId string | null
  • savedSearchId string | null

  • sort object | null | array[object]

    One of:

    Security_Solution_Timeline_API_SortObject object | null array-2 array[object] | null

    Hide attributes Show attributes

    • columnId string | null
    • columnType string | null
    • sortDirection string | null

    Hide attributes Show attributes object

    • columnId string | null
    • columnType string | null
    • sortDirection string | null
  • status string | null

    Values are active, draft, or immutable.

  • templateTimelineId string | null
  • templateTimelineVersion number | null
  • timelineType string | null

    The type of timeline to create. Valid values are default and template.

    Values are default or template.

  • title string | null
  • updated number | null
  • updatedBy string | null
  • eventNotes array[object] | null
    Hide eventNotes attributes Show eventNotes attributes object

    • created number | null
    • createdBy string | null
    • eventId string | null
    • note string | null
    • timelineId string | null Required
    • updated number | null
    • updatedBy string | null
  • globalNotes array[object] | null
    Hide globalNotes attributes Show globalNotes attributes object

    • created number | null
    • createdBy string | null
    • eventId string | null
    • note string | null
    • timelineId string | null Required
    • updated number | null
    • updatedBy string | null
  • pinnedEventIds array[string] | null
  • savedObjectId string | null
  • version string | null