Install prepackaged Timelines

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

The Timelines to install or update.

prepackagedTimelines object[] required

− Hide 32 properties

columns object[] nullable

The Timeline's columns

+ Show 11 properties

created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataProviders object[] nullable

Object containing query clauses

+ Show 8 properties

dataViewId string nullable

ID of the Timeline's Data View

dateRange object nullable

The Timeline's search period.

+ Show 2 properties

description string nullable

The Timeline's description

eqlOptions object nullable

EQL query that is used in the correlation tab

+ Show 5 properties

eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek

favorite object[] nullable

+ Show 3 properties

filters object[] nullable

A list of filters that should be applied to the query

+ Show 7 properties

indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

• filter: filters query results
• search: displays additional search results

kqlQuery object

KQL bar query.

+ Show 1 property

savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

sort union oneOf

object or object[]

+ Show 3 properties

status enum

The status of the Timeline.

Values: active draft immutable

templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template

title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

eventIdToNoteIds object[] nullable

+ Show 9 properties

noteIds string[] nullable

notes object[] nullable

+ Show 9 properties

pinnedEventIds string[] nullable

pinnedEventsSaveObject object[] nullable

+ Show 8 properties

savedObjectId string required

version string required

timelinesToInstall object[] required

− Hide 30 properties

columns object[] nullable

The Timeline's columns

Same fields as columns in prepackagedTimelines

created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataProviders object[] nullable

Object containing query clauses

Same fields as dataProviders in prepackagedTimelines

dataViewId string nullable

ID of the Timeline's Data View

dateRange object nullable

The Timeline's search period.

+ Show 2 properties

description string nullable

The Timeline's description

eqlOptions object nullable

EQL query that is used in the correlation tab

+ Show 5 properties

eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek

favorite object[] nullable

+ Show 3 properties

filters object[] nullable

A list of filters that should be applied to the query

Same fields as filters in prepackagedTimelines

indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

• filter: filters query results
• search: displays additional search results

kqlQuery object

KQL bar query.

+ Show 1 property

savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

sort union oneOf

object or object[]

+ Show 3 properties

status enum

The status of the Timeline.

Values: active draft immutable

templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template

title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

eventNotes object[] required nullable

− Hide 7 properties

created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

The _id of the associated event for this note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline that this note is associated with

globalNotes object[] required nullable

− Hide 7 properties

created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

The _id of the associated event for this note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline that this note is associated with

pinnedEventIds string[] required nullable

savedObjectId string required nullable

version string required nullable

timelinesToUpdate object[] required

Same fields as timelinesToInstall