Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Timeline API

Get draft Timeline or Timeline template details

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_draft</span></div>

Refer to Spaces for more information.

Get the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned.

get/api/timeline/_draft

Query parameters

timelineType'default' | 'template' required

The type of Timeline.

Which draft to load (default investigation timeline or template timeline template).

Response

Indicates a successful call.

creatednumber nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBystring nullable

The user who created the Timeline.

dataViewIdstring nullable

ID of the Timeline's Data View

descriptionstring nullable

The Timeline's description

eventTypestring nullable

Event types displayed in the Timeline

excludedRowRendererIdsSecurityTimelineAPIRowRendererId[] nullable

A list of row renderers that should not be used when in Event renderers mode

indexNamesstring[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlModestring nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

  • filter: filters query results
  • search: displays additional search results
savedQueryIdstring nullable

The ID of the saved query that might be used in the Query tab

savedSearchIdstring nullable

The ID of the saved search that is used in the ES|QL tab

status'active' | 'draft' | 'immutable'

The status of the Timeline.

templateTimelineIdstring nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersionnumber nullable

Timeline template version number. For Timelines, the value is null.

timelineType'default' | 'template'

The type of Timeline.

titlestring nullable

The Timeline's title.

updatednumber nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBystring nullable

The user who last updated the Timeline

savedObjectIdstring required

The savedObjectId of the Timeline or Timeline template

versionstring required

The version of the Timeline or Timeline template

noteIdsstring[] nullable

A list of all the ids of notes that are associated to this Timeline.

pinnedEventIdsstring[] nullable

A list of all the ids of pinned events that are associated to this Timeline.

Example response

{
  "columns": [
    {
      "columnHeaderType": "not-filtered",
      "id": "@timestamp"
    },
    {
      "columnHeaderType": "not-filtered",
      "id": "event.category"
    }
  ],
  "created": 1587468588922,
  "createdBy": "casetester",
  "dataProviders": [
    {
      "enabled": true,
      "excluded": false,
      "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
      "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
      "queryMatch": {
        "field": "_id,",
        "operator": ":",
        "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
      }
    }
  ],
  "dataViewId": "security-solution-default",
  "dateRange": {
    "end": 1587456479201,
    "start": 1587370079200
  },
  "description": "Investigating exposure of CVE XYZ",
  "eqlOptions": {
    "eventCategoryField": "event.category",
    "query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
    "size": 100,
    "timestampField": "@timestamp"
  },
  "eventType": "all",
  "favorite": [
    {
      "favoriteDate": 1741337636741,
      "userName": "elastic"
    }
  ],
  "filters": [
    {
      "meta": {
        "alias": "Custom filter name",
        "disabled": false,
        "index": ".alerts-security.alerts-default,logs-*",
        "key": "@timestamp",
        "negate": "false,",
        "type": "exists",
        "value": "exists"
      },
      "query": "{\"exists\":{\"field\":\"@timestamp\"}}"
    }
  ],
  "indexNames": [
    ".logs*"
  ],
  "kqlMode": "search",
  "kqlQuery": {
    "filterQuery": null,
    "kuery": {
      "expression": "_id : *",
      "kind": "kuery"
    },
    "serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
  },
  "savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
  "savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
  "sort": {
    "columnId": "@timestamp",
    "sortDirection": "desc"
  },
  "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
  "templateTimelineVersion": 12,
  "title": "CVE XYZ investigation",
  "updated": 1741344876825,
  "updatedBy": "casetester",
  "savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
  "version": "WzE0LDFd",
  "eventIdToNoteIds": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "This is an example text",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "version": "WzQ2LDFd"
    }
  ],
  "noteIds": [
    "709f99c6-89b6-4953-9160-35945c8e174e"
  ],
  "notes": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "This is an example text",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "version": "WzQ2LDFd"
    }
  ],
  "pinnedEventIds": [
    "983f99c6-89b6-4953-9160-35945c8a194f"
  ],
  "pinnedEventsSaveObject": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
      "version": "WzQ2LDFe"
    }
  ]
}