Security Timeline API
Install prepackaged Timelines
Spaces method and path for this operation:
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/timeline/_prepackaged</span></div>Refer to Spaces for more information.
Install or update prepackaged Timelines.
post/api/timeline/_prepackaged
Request body
Example request
{
"prepackagedTimelines": [
{
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
}
],
"created": 1587468588922,
"createdBy": "casetester",
"dataProviders": [
{
"enabled": true,
"excluded": false,
"id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"queryMatch": {
"field": "_id,",
"operator": ":",
"value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
}
}
],
"dataViewId": "security-solution-default",
"dateRange": {
"end": 1587456479201,
"start": 1587370079200
},
"description": "Investigating exposure of CVE XYZ",
"eqlOptions": {
"eventCategoryField": "event.category",
"query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
"size": 100,
"timestampField": "@timestamp"
},
"eventType": "all",
"favorite": [
{
"favoriteDate": 1741337636741,
"userName": "elastic"
}
],
"filters": [
{
"meta": {
"alias": "Custom filter name",
"disabled": false,
"index": ".alerts-security.alerts-default,logs-*",
"key": "@timestamp",
"negate": "false,",
"type": "exists",
"value": "exists"
},
"query": "{\"exists\":{\"field\":\"@timestamp\"}}"
}
],
"indexNames": [
".logs*"
],
"kqlMode": "search",
"kqlQuery": {
"filterQuery": null,
"kuery": {
"expression": "_id : *",
"kind": "kuery"
},
"serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
},
"savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
"savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"templateTimelineVersion": 12,
"title": "CVE XYZ investigation",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventIdToNoteIds": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"version": "WzQ2LDFd"
}
],
"notes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"version": "WzQ2LDFd"
}
],
"pinnedEventsSaveObject": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
"version": "WzQ2LDFe"
}
]
}
],
"timelinesToInstall": [
{
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
}
],
"created": 1587468588922,
"createdBy": "casetester",
"dataProviders": [
{
"enabled": true,
"excluded": false,
"id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"queryMatch": {
"field": "_id,",
"operator": ":",
"value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
}
}
],
"dataViewId": "security-solution-default",
"dateRange": {
"end": 1587456479201,
"start": 1587370079200
},
"description": "Investigating exposure of CVE XYZ",
"eqlOptions": {
"eventCategoryField": "event.category",
"query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
"size": 100,
"timestampField": "@timestamp"
},
"eventType": "all",
"favorite": [
{
"favoriteDate": 1741337636741,
"userName": "elastic"
}
],
"filters": [
{
"meta": {
"alias": "Custom filter name",
"disabled": false,
"index": ".alerts-security.alerts-default,logs-*",
"key": "@timestamp",
"negate": "false,",
"type": "exists",
"value": "exists"
},
"query": "{\"exists\":{\"field\":\"@timestamp\"}}"
}
],
"indexNames": [
".logs*"
],
"kqlMode": "search",
"kqlQuery": {
"filterQuery": null,
"kuery": {
"expression": "_id : *",
"kind": "kuery"
},
"serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
},
"savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
"savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"templateTimelineVersion": 12,
"title": "CVE XYZ investigation",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventNotes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
],
"globalNotes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
]
}
],
"timelinesToUpdate": [
{
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
}
],
"created": 1587468588922,
"createdBy": "casetester",
"dataProviders": [
{
"enabled": true,
"excluded": false,
"id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
"queryMatch": {
"field": "_id,",
"operator": ":",
"value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
}
}
],
"dataViewId": "security-solution-default",
"dateRange": {
"end": 1587456479201,
"start": 1587370079200
},
"description": "Investigating exposure of CVE XYZ",
"eqlOptions": {
"eventCategoryField": "event.category",
"query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
"size": 100,
"timestampField": "@timestamp"
},
"eventType": "all",
"favorite": [
{
"favoriteDate": 1741337636741,
"userName": "elastic"
}
],
"filters": [
{
"meta": {
"alias": "Custom filter name",
"disabled": false,
"index": ".alerts-security.alerts-default,logs-*",
"key": "@timestamp",
"negate": "false,",
"type": "exists",
"value": "exists"
},
"query": "{\"exists\":{\"field\":\"@timestamp\"}}"
}
],
"indexNames": [
".logs*"
],
"kqlMode": "search",
"kqlQuery": {
"filterQuery": null,
"kuery": {
"expression": "_id : *",
"kind": "kuery"
},
"serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
},
"savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
"savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
"templateTimelineVersion": 12,
"title": "CVE XYZ investigation",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventNotes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
],
"globalNotes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
}
]
}
]
}Response
Indicates a successful call.
Example response
{
"errors": [
{
"error": {
"message": "Malformed JSON",
"status_code": 400
},
"id": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
}
],
"success_count": 99,
"timelines_installed": 80,
"timelines_updated": 19
}