Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Timeline API

Create a Timeline or Timeline template

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline</span></div>

Refer to Spaces for more information.

Create a new Timeline or Timeline template.

post/api/timeline

Request body

status'active' | 'draft' | 'immutable'

The status of the Timeline.

templateTimelineIdstring nullable

A unique identifier for the Timeline template.

templateTimelineVersionnumber nullable

Timeline template version number.

timelineIdstring nullable

A unique identifier for the Timeline.

timelineType'default' | 'template'

The type of Timeline.

versionstring nullable

Example request

{
  "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
  "templateTimelineVersion": 12,
  "timeline": {
    "columns": [
      {
        "columnHeaderType": "not-filtered",
        "id": "@timestamp"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "event.category"
      }
    ],
    "created": 1587468588922,
    "createdBy": "casetester",
    "dataProviders": [
      {
        "enabled": true,
        "excluded": false,
        "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
        "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
        "queryMatch": {
          "field": "_id,",
          "operator": ":",
          "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
        }
      }
    ],
    "dataViewId": "security-solution-default",
    "dateRange": {
      "end": 1587456479201,
      "start": 1587370079200
    },
    "description": "Investigating exposure of CVE XYZ",
    "eqlOptions": {
      "eventCategoryField": "event.category",
      "query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
      "size": 100,
      "timestampField": "@timestamp"
    },
    "eventType": "all",
    "favorite": [
      {
        "favoriteDate": 1741337636741,
        "userName": "elastic"
      }
    ],
    "filters": [
      {
        "meta": {
          "alias": "Custom filter name",
          "disabled": false,
          "index": ".alerts-security.alerts-default,logs-*",
          "key": "@timestamp",
          "negate": "false,",
          "type": "exists",
          "value": "exists"
        },
        "query": "{\"exists\":{\"field\":\"@timestamp\"}}"
      }
    ],
    "indexNames": [
      ".logs*"
    ],
    "kqlMode": "search",
    "kqlQuery": {
      "filterQuery": null,
      "kuery": {
        "expression": "_id : *",
        "kind": "kuery"
      },
      "serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
    },
    "savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
    "savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
    "sort": {
      "columnId": "@timestamp",
      "sortDirection": "desc"
    },
    "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
    "templateTimelineVersion": 12,
    "title": "CVE XYZ investigation",
    "updated": 1741344876825,
    "updatedBy": "casetester"
  },
  "timelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075"
}

Response

Indicates a successful call.

creatednumber nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBystring nullable

The user who created the Timeline.

dataViewIdstring nullable

ID of the Timeline's Data View

descriptionstring nullable

The Timeline's description

eventTypestring nullable

Event types displayed in the Timeline

excludedRowRendererIdsSecurityTimelineAPIRowRendererId[] nullable

A list of row renderers that should not be used when in Event renderers mode

indexNamesstring[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlModestring nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

  • filter: filters query results
  • search: displays additional search results
savedQueryIdstring nullable

The ID of the saved query that might be used in the Query tab

savedSearchIdstring nullable

The ID of the saved search that is used in the ES|QL tab

status'active' | 'draft' | 'immutable'

The status of the Timeline.

templateTimelineIdstring nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersionnumber nullable

Timeline template version number. For Timelines, the value is null.

timelineType'default' | 'template'

The type of Timeline.

titlestring nullable

The Timeline's title.

updatednumber nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBystring nullable

The user who last updated the Timeline

savedObjectIdstring required

The savedObjectId of the Timeline or Timeline template

versionstring required

The version of the Timeline or Timeline template

noteIdsstring[] nullable

A list of all the ids of notes that are associated to this Timeline.

pinnedEventIdsstring[] nullable

A list of all the ids of pinned events that are associated to this Timeline.

Example response

{
  "columns": [
    {
      "columnHeaderType": "not-filtered",
      "id": "@timestamp"
    },
    {
      "columnHeaderType": "not-filtered",
      "id": "event.category"
    }
  ],
  "created": 1587468588922,
  "createdBy": "casetester",
  "dataProviders": [
    {
      "enabled": true,
      "excluded": false,
      "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
      "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
      "queryMatch": {
        "field": "_id,",
        "operator": ":",
        "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
      }
    }
  ],
  "dataViewId": "security-solution-default",
  "dateRange": {
    "end": 1587456479201,
    "start": 1587370079200
  },
  "description": "Investigating exposure of CVE XYZ",
  "eqlOptions": {
    "eventCategoryField": "event.category",
    "query": "sequence\\n[process where process.name == \"sudo\"]\\n[any where true]",
    "size": 100,
    "timestampField": "@timestamp"
  },
  "eventType": "all",
  "favorite": [
    {
      "favoriteDate": 1741337636741,
      "userName": "elastic"
    }
  ],
  "filters": [
    {
      "meta": {
        "alias": "Custom filter name",
        "disabled": false,
        "index": ".alerts-security.alerts-default,logs-*",
        "key": "@timestamp",
        "negate": "false,",
        "type": "exists",
        "value": "exists"
      },
      "query": "{\"exists\":{\"field\":\"@timestamp\"}}"
    }
  ],
  "indexNames": [
    ".logs*"
  ],
  "kqlMode": "search",
  "kqlQuery": {
    "filterQuery": null,
    "kuery": {
      "expression": "_id : *",
      "kind": "kuery"
    },
    "serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"_id\"}}],\"minimum_should_match\":1}}"
  },
  "savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
  "savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
  "sort": {
    "columnId": "@timestamp",
    "sortDirection": "desc"
  },
  "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
  "templateTimelineVersion": 12,
  "title": "CVE XYZ investigation",
  "updated": 1741344876825,
  "updatedBy": "casetester",
  "savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
  "version": "WzE0LDFd",
  "eventIdToNoteIds": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "This is an example text",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "version": "WzQ2LDFd"
    }
  ],
  "noteIds": [
    "709f99c6-89b6-4953-9160-35945c8e174e"
  ],
  "notes": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "This is an example text",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "version": "WzQ2LDFd"
    }
  ],
  "pinnedEventIds": [
    "983f99c6-89b6-4953-9160-35945c8a194f"
  ],
  "pinnedEventsSaveObject": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
      "version": "WzQ2LDFe"
    }
  ]
}