Get draft Timeline or Timeline template details
Get the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned.
Query parameters
-
timelineType
string | null Required The type of Timeline.
Values are
default
ortemplate
.
Responses
-
200 application/json
Indicates that the draft Timeline was successfully retrieved.
Hide response attributes Show response attributes object
-
columns
array[object] | null The Timeline's columns
Hide columns attributes Show columns attributes object
-
aggregatable
boolean | null -
category
string | null -
columnHeaderType
string | null -
description
string | null -
example
string | null -
id
string | null -
indexes
array[string] | null -
name
string | null -
placeholder
string | null -
searchable
boolean | null -
type
string | null
-
-
created
number | null The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBy
string | null The user who created the Timeline.
-
dataProviders
array[object] | null Object containing query clauses
Hide dataProviders attributes Show dataProviders attributes object
-
and
array[object] | null Hide and attributes Show and attributes object
-
enabled
boolean | null -
excluded
boolean | null -
id
string | null -
kqlQuery
string | null -
name
string | null -
queryMatch
object | null Hide queryMatch attributes Show queryMatch attributes object | null
-
displayField
string | null -
displayValue
string | null -
field
string | null -
operator
string | null value
string | null | array[string]
-
-
type
string | null The type of data provider.
Values are
default
ortemplate
.
-
-
enabled
boolean | null -
excluded
boolean | null -
id
string | null -
kqlQuery
string | null -
name
string | null -
queryMatch
object | null Hide queryMatch attributes Show queryMatch attributes object | null
-
displayField
string | null -
displayValue
string | null -
field
string | null -
operator
string | null value
string | null | array[string]
-
-
type
string | null The type of data provider.
Values are
default
ortemplate
.
-
-
dataViewId
string | null ID of the Timeline's Data View
-
dateRange
object | null The Timeline's search period.
Hide dateRange attributes Show dateRange attributes object | null
-
description
string | null The Timeline's description
-
eqlOptions
object | null EQL query that is used in the correlation tab
Hide eqlOptions attributes Show eqlOptions attributes object | null
-
eventCategoryField
string | null -
query
string | null size
string | null | number size
string | null | number -
tiebreakerField
string | null -
timestampField
string | null
-
-
eventType
string | null Deprecated Event types displayed in the Timeline
-
excludedRowRendererIds
array[string] | null A list of row renderers that should not be used when in
Event renderers
modeValues are
alert
,alerts
,auditd
,auditd_file
,library
,netflow
,plain
,registry
,suricata
,system
,system_dns
,system_endgame_process
,system_file
,system_fim
,system_security_event
,system_socket
,threat_match
, orzeek
. -
favorite
array[object] | null Indicates when and who marked a Timeline as a favorite.
Hide favorite attributes Show favorite attributes object
-
favoriteDate
number | null -
fullName
string | null -
userName
string | null
-
-
filters
array[object] | null A list of filters that should be applied to the query
Hide filters attributes Show filters attributes object
-
indexNames
array[string] | null A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlMode
string | null Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter
: filters query resultssearch
: displays additional search results
-
kqlQuery
object | null KQL bar query.
Hide kqlQuery attribute Show kqlQuery attribute object | null
-
filterQuery
object | null Hide filterQuery attributes Show filterQuery attributes object | null
-
kuery
object | null Hide kuery attributes Show kuery attributes object | null
-
expression
string | null -
kind
string | null
-
-
serializedQuery
string | null
-
-
-
savedQueryId
string | null The ID of the saved query that might be used in the Query tab
-
savedSearchId
string | null The ID of the saved search that is used in the ES|QL tab
sort
object | null | array[object] One of: Object indicating how rows are sorted in the Timeline's grid
Hide attributes Show attributes
-
columnId
string | null -
columnType
string | null -
sortDirection
string | null
Object indicating how rows are sorted in the Timeline's grid
Hide attributes Show attributes object
-
columnId
string | null -
columnType
string | null -
sortDirection
string | null
-
sort
object | null | array[object] One of: Object indicating how rows are sorted in the Timeline's grid
Hide attributes Show attributes
-
columnId
string | null -
columnType
string | null -
sortDirection
string | null
Object indicating how rows are sorted in the Timeline's grid
Hide attributes Show attributes object
-
columnId
string | null -
columnType
string | null -
sortDirection
string | null
-
-
status
string | null The status of the Timeline.
Values are
active
,draft
, orimmutable
. -
templateTimelineId
string | null A unique ID (UUID) for Timeline templates. For Timelines, the value is
null
. -
templateTimelineVersion
number | null Timeline template version number. For Timelines, the value is
null
. -
timelineType
string | null The type of Timeline.
Values are
default
ortemplate
. -
title
string | null The Timeline's title.
-
updated
number | null The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBy
string | null The user who last updated the Timeline
-
savedObjectId
string Required The
savedObjectId
of the Timeline or Timeline template -
version
string Required The version of the Timeline or Timeline template
-
eventIdToNoteIds
array[object] | null A list of all the notes that are associated to this Timeline.
Hide eventIdToNoteIds attributes Show eventIdToNoteIds attributes object
-
created
number | null The time the note was created, using a 13-digit Epoch timestamp.
-
createdBy
string | null The user who created the note.
-
updated
number | null The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBy
string | null The user who last updated the note
-
eventId
string | null The
_id
of the associated event for this note. -
note
string | null The text of the note
-
timelineId
string Required The
savedObjectId
of the Timeline that this note is associated with -
noteId
string Required The
savedObjectId
of the note -
version
string Required The version of the note
-
-
noteIds
array[string] | null A list of all the ids of notes that are associated to this Timeline.
-
notes
array[object] | null A list of all the notes that are associated to this Timeline.
Hide notes attributes Show notes attributes object
-
created
number | null The time the note was created, using a 13-digit Epoch timestamp.
-
createdBy
string | null The user who created the note.
-
updated
number | null The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBy
string | null The user who last updated the note
-
eventId
string | null The
_id
of the associated event for this note. -
note
string | null The text of the note
-
timelineId
string Required The
savedObjectId
of the Timeline that this note is associated with -
noteId
string Required The
savedObjectId
of the note -
version
string Required The version of the note
-
-
pinnedEventIds
array[string] | null A list of all the ids of pinned events that are associated to this Timeline.
-
pinnedEventsSaveObject
array[object] | null A list of all the pinned events that are associated to this Timeline.
Hide pinnedEventsSaveObject attributes Show pinnedEventsSaveObject attributes object
-
created
number | null The time the pinned event was created, using a 13-digit Epoch timestamp.
-
createdBy
string | null The user who created the pinned event.
-
updated
number | null The last time the pinned event was updated, using a 13-digit Epoch timestamp
-
updatedBy
string | null The user who last updated the pinned event
-
eventId
string Required The
_id
of the associated event for this pinned event. -
timelineId
string Required The
savedObjectId
of the timeline that this pinned event is associated with -
pinnedEventId
string Required The
savedObjectId
of this pinned event -
version
string Required The version of this pinned event
-
-
-
403 application:json
If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.
Hide response attributes Show response attributes object
-
message
string -
status_code
number
-
-
409 application:json
This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given
timelineId
.Hide response attributes Show response attributes object
-
message
string -
status_code
number
-
curl \
--request GET 'http://api.example.com/api/timeline/_draft?timelineType=default' \
--header "Authorization: $API_KEY"