Get Timeline or Timeline template details

Base URL: https://{kibana_url}

GET /api/timeline
GET /s/{space_id}/api/timeline

Auth

Get the details of an existing saved Timeline or Timeline template.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

template_timeline_id string: The savedObjectId of the template timeline to retrieve
id string: The savedObjectId of the Timeline to retrieve.

Response

Indicates that the (template) Timeline was found and returned.

application/json

One of:

data object required

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/timeline

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/timeline" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "getOneTimeline": {
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        }
      ],
      "created": 1587468588922,
      "createdBy": "casetester",
      "dataProviders": [
        {
          "enabled": true,
          "excluded": false,
          "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
          "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
          "queryMatch": {
            "field": "_id,",
            "operator": ":",
            "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
          }
        }
      ],
      "dataViewId": "security-solution-default",
      "dateRange": {
        "end": 1587456479201,
        "start": 1587370079200
      },
      "description": "Investigating exposure of CVE XYZ",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "query": "sequence\\n[process where process.name == \u0022sudo\u0022]\\n[any where true]",
        "size": 100,
        "timestampField": "@timestamp"
      },
      "eventType": "all",
      "excludedRowRendererIds": [
        "alert"
      ],
      "favorite": [
        {
          "favoriteDate": 1741337636741,
          "userName": "elastic"
        }
      ],
      "filters": [
        {
          "meta": {
            "alias": "Custom filter name",
            "disabled": false,
            "index": ".alerts-security.alerts-default,logs-*",
            "key": "@timestamp",
            "negate": "false,",
            "type": "exists",
            "value": "exists"
          },
          "query": "{\u0022exists\u0022:{\u0022field\u0022:\u0022@timestamp\u0022}}"
        }
      ],
      "indexNames": [
        ".logs*"
      ],
      "kqlMode": "search",
      "kqlQuery": {
        "filterQuery": "null",
        "kuery": {
          "expression": "_id : *",
          "kind": "kuery"
        },
        "serializedQuery": "{\u0022bool\u0022:{\u0022should\u0022:[{\u0022exists\u0022:{\u0022field\u0022:\u0022_id\u0022}}],\u0022minimum_should_match\u0022:1}}"
      },
      "savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
      "savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
      "sort": {
        "columnId": "@timestamp",
        "sortDirection": "desc"
      },
      "status": "active",
      "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
      "templateTimelineVersion": 12,
      "timelineType": "default",
      "title": "CVE XYZ investigation",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "version": "WzE0LDFd",
      "eventIdToNoteIds": [
        {
          "created": 1587468588922,
          "createdBy": "casetester",
          "updated": 1741344876825,
          "updatedBy": "casetester",
          "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
          "note": "This is an example text",
          "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
          "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
          "version": "WzQ2LDFd"
        }
      ],
      "noteIds": [
        "709f99c6-89b6-4953-9160-35945c8e174e"
      ],
      "notes": [
        {
          "created": 1587468588922,
          "createdBy": "casetester",
          "updated": 1741344876825,
          "updatedBy": "casetester",
          "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
          "note": "This is an example text",
          "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
          "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
          "version": "WzQ2LDFd"
        }
      ],
      "pinnedEventIds": [
        "983f99c6-89b6-4953-9160-35945c8a194f"
      ],
      "pinnedEventsSaveObject": [
        {
          "created": 1587468588922,
          "createdBy": "casetester",
          "updated": 1741344876825,
          "updatedBy": "casetester",
          "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
          "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
          "pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
          "version": "WzQ2LDFe"
        }
      ]
    }
  }
}

Generated from the API spec