stack kb security-timeline-api get-notes cli command

elastic stack kb security-timeline-api get-notes [options]

Get notes

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--document-ids string

Event document _id values to match against each note's eventId. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using page/perPage.

Repeatable: pass --document-ids multiple times to supply more than one value

--saved-object-ids string

Timeline savedObjectId value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.

Repeatable: pass --saved-object-ids multiple times to supply more than one value

--page string

Page number for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 1.

--per-page string

Page size for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 10.

--search string

Search string for saved-objects find (list mode only).

--sort-field string

Field to sort by for saved-objects find (list mode only).

--sort-order string

Sort order (asc or desc) for saved-objects find (list mode only).

--filter string

Kuery filter string combined with other list-mode filters (for example createdByFilter or associatedFilter). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).

--created-by-filter string

Kibana user profile UID (UUID). The server resolves the user's display identifiers and returns notes whose createdBy matches any of them (list mode only).

--associated-filter enum

Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when documentIds or savedObjectIds is used.

Values: all, document_only, saved_object_only, document_and_saved_object, orphan

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON