Get Timeline template by templateTimelineId

edit

Get Timeline template by templateTimelineIdedit

Retrieves details of a single Timeline template using templateTimelineId.

Request URLedit

GET <kibana host>:<port>/api/timeline?template_timeline_id=<templateTimelineId>

URL query parametersedit

Name Type Description Required

template_timeline_id

String

The templateTimelineId of an existing Timeline template.

Yes

Example requestsedit

Retrieves details of a Timeline template with the templateTimelineId value of 300afc76-072d-4261-864d-4149714bf3f1:

GET /api/timeline?template_timeline_id=300afc76-072d-4261-864d-4149714bf3f1

Response codeedit

200
Indicates a successful call.

Example responseedit

{
  "data": {
    "getOneTimeline": {
      "savedObjectId": "f9ae2a43-823d-4abe-964f-084591607930",
      "version": "WzQwMjQsMV0=",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "number"
        },
        {
          "aggregatable": false,
          "description": "For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.",
          "columnHeaderType": "not-filtered",
          "id": "message",
          "category": "base",
          "type": "string",
          "example": "Hello World"
        },
        {
          "aggregatable": true,
          "description": "The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
          "columnHeaderType": "not-filtered",
          "id": "event.action",
          "category": "event",
          "type": "string",
          "example": "user-password-change"
        },
        {
          "aggregatable": true,
          "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. See the documentation section \"Implementing ECS\".",
          "columnHeaderType": "not-filtered",
          "id": "network.type",
          "category": "network",
          "type": "string",
          "example": "ipv4"
        },
        {
          "aggregatable": true,
          "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. See the documentation section \"Implementing ECS\".",
          "columnHeaderType": "not-filtered",
          "id": "network.transport",
          "category": "network",
          "type": "string",
          "example": "tcp"
        },
        {
          "aggregatable": true,
          "description": "Direction of the network traffic. Recommended values are: * inbound * outbound * internal * external * unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view. When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of your network perimeter.",
          "columnHeaderType": "not-filtered",
          "id": "network.direction",
          "category": "network",
          "type": "string",
          "example": "inbound"
        },
        {
          "aggregatable": true,
          "description": "IP address of the source. Can be one or multiple IPv4 or IPv6 addresses.",
          "columnHeaderType": "not-filtered",
          "id": "source.ip",
          "category": "source",
          "type": "ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.port"
        },
        {
          "aggregatable": true,
          "description": "IP address of the destination. Can be one or multiple IPv4 or IPv6 addresses.",
          "columnHeaderType": "not-filtered",
          "id": "destination.ip",
          "category": "destination",
          "type": "ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.port"
        },
        {
          "aggregatable": true,
          "description": "Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.",
          "columnHeaderType": "not-filtered",
          "id": "host.name",
          "category": "host",
          "type": "string"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [
        {
          "excluded": false,
          "and": [],
          "kqlQuery": "",
          "name": "network",
          "queryMatch": {
            "displayValue": null,
            "field": "event.category",
            "displayField": null,
            "value": "network",
            "operator": ":"
          },
          "id": "timeline-1-dbab0164-2150-47a1-a66f-75ebafe24d5c",
          "type": "default",
          "enabled": true
        },
        {
          "excluded": false,
          "and": [],
          "kqlQuery": "",
          "name": "{signal.group.id}",
          "queryMatch": {
            "displayValue": null,
            "field": "signal.group.id",
            "displayField": null,
            "value": "{signal.group.id}",
            "operator": ":"
          },
          "id": "timeline-1-15b52ead-4956-4ed0-bd12-e137eaf4467e",
          "type": "template",
          "enabled": true
        },
        {
          "excluded": false,
          "and": [],
          "kqlQuery": "",
          "name": "{signal.original_event.id}",
          "queryMatch": {
            "field": "signal.original_event.id",
            "value": "{signal.original_event.id}",
            "operator": ":"
          },
          "id": "timeline-1-2164774f-6409-4ac4-b73c-907914baf058",
          "type": "template",
          "enabled": true
        }
      ],
      "dataViewId": null,
      "description": "",
      "eqlOptions": {
        "tiebreakerField": "",
        "size": 100,
        "query": "",
        "eventCategoryField": "event.category",
        "timestampField": "@timestamp"
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": null
      },
      "title": "Comprehensive Network Timeline",
      "templateTimelineId": "300afc76-072d-4261-864d-4149714bf3f1",
      "templateTimelineVersion": 2,
      "dateRange": {
        "start": "2024-02-19T15:42:52.321Z",
        "end": "2024-02-20T15:42:52.322Z"
      },
      "savedQueryId": null,
      "created": 1708443772322,
      "createdBy": "Elastic",
      "updated": 1708443772322,
      "updatedBy": "Elastic",
      "timelineType": "template",
      "status": "immutable",
      "sort": [
        {
          "columnType": "number",
          "sortDirection": "desc",
          "columnId": "@timestamp"
        }
      ],
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    }
  }
}