1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
{
"customTemplateTimelineCount": 2,
"defaultTimelineCount": 90,
"elasticTemplateTimelineCount": 8,
"favoriteCount": 5,
"templateTimelineCount": 10,
"timeline": [
{
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
}
],
"created": 1587468588922,
"createdBy": "casetester",
"dataProviders": [
{
"enabled": true,
"excluded": false,
"id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"queryMatch": {
"field": "_id,",
"operator": ":",
"value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
}
}
],
"dataViewId": "security-solution-default",
"dateRange": {
"end": 1587456479201,
"start": 1587370079200
},
"description": "Investigating exposure of CVE XYZ",
"eqlOptions": {
"eventCategoryField": "event.category",
"query": "sequence\\n[process where process.name == \u0022sudo\u0022]\\n[any where true]",
"size": 100,
"timestampField": "@timestamp"
},
"eventType": "all",
"excludedRowRendererIds": [
"alert"
],
"favorite": [
{
"favoriteDate": 1741337636741,
"userName": "elastic"
}
],
"filters": [
{
"meta": {
"alias": "Custom filter name",
"disabled": false,
"index": ".alerts-security.alerts-default,logs-*",
"key": "@timestamp",
"negate": "false,",
"type": "exists",
"value": "exists"
},
"query": "{\u0022exists\u0022:{\u0022field\u0022:\u0022@timestamp\u0022}}"
}
],
"indexNames": [
".logs*"
],
"kqlMode": "search",
"kqlQuery": {
"filterQuery": "null",
"kuery": {
"expression": "_id : *",
"kind": "kuery"
},
"serializedQuery": "{\u0022bool\u0022:{\u0022should\u0022:[{\u0022exists\u0022:{\u0022field\u0022:\u0022_id\u0022}}],\u0022minimum_should_match\u0022:1}}"
},
"savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
"savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"status": "active",
"templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"templateTimelineVersion": 12,
"timelineType": "default",
"title": "CVE XYZ investigation",
"updated": 1741344876825,
"updatedBy": "casetester",
"savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"version": "WzE0LDFd",
"eventIdToNoteIds": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"version": "WzQ2LDFd"
}
],
"noteIds": [
"709f99c6-89b6-4953-9160-35945c8e174e"
],
"notes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"version": "WzQ2LDFd"
}
],
"pinnedEventIds": [
"983f99c6-89b6-4953-9160-35945c8a194f"
],
"pinnedEventsSaveObject": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
"version": "WzQ2LDFe"
}
]
}
],
"totalCount": 100
}