Skip to content

Commit a334fea

Browse files
author
Ben Skelker
committed
timeline schema
1 parent ab3b47c commit a334fea

File tree

1 file changed

+163
-19
lines changed

1 file changed

+163
-19
lines changed

‎docs/siem/reference/timeline-schema.asciidoc‎

Lines changed: 163 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,42 +6,186 @@
66
|==============================================
77
|Name |Type |Description
88

9-
|`columns` |Object[] |The timeline's displayed columns.
10-
|`created` |Float |The time the timeline was created, using a
11-
13-digit Epoch timestamp.
9+
|`columns` |<<col-obj, columns[]>> |The timeline columns displayed in the UI.
10+
|`created` |Float |The time the timeline was created, using a 13-digit Epoch
11+
timestamp.
1212
|`createdBy` |String |The user who created the timeline.
13-
|`dataProviders` |Object[] |The dropzone query.
13+
|`dataProviders` |<<dataProvider-obj, dataProviders[]>> |The dropzone query
14+
that determines which events are displayed in the timeline.???
1415
|`dateRange` |Object |The timeline's range.
1516
|`description` |String |The timeline's description.
16-
|`eventNotes` |Object[] |Notes added to specific events in the timeline.
17+
|`eventNotes` |<<eventNotes-obj, eventNotes[]>> |Notes added to specific
18+
events in the timeline.
1719
|`eventType` |String a|Event types displayed in the timeline, which can be:
1820

1921
* `all`: all events
2022
* `raw`: raw events only
2123
* `signal`: signals only
2224

23-
|`favorite` |Object[] |Indicates who and marked a timeline as a favorite.
24-
|`filters` |Object[] |Filters used in addition to the dropzone query.
25-
|`globalNotes` |Object[] |Notes added to the timeline.
26-
|`kqlMode` |String a|Indicates whether the dropzone queries are filtered (`and`) or additional search results are displayed (`or`), can be:
25+
|`favorite` |<<favorite-obj, favorite[]>> |Indicates who marked a timeline as a
26+
favorite, and at what time.
27+
|`filters` |<<filters-obj, filters[]>> |Filters used in addition to the
28+
dropzone query. ???
29+
|`globalNotes` |<<globalNotes-obj, Object[]>> |Notes added to the timeline.
30+
|`kqlMode` |String a|Indicates whether the KQL bar filters or searches the
31+
dropzone query, where:
2732

2833
* `filter`: filters dropzone query results
2934
* `search`: displays additional search results
3035

31-
|`kqlQuery` |Object |Indicates whether additional filters use KQL or Lucene
32-
queries.
33-
|`pinnedEventIds` |Object[] |Pinned row IDs.
34-
|`savedObjectId` |String |Saved object ID.
36+
|`kqlQuery` |<<kqlQuery-obj, kqlQuery>> |Object describing the KQL bar query.
37+
|`pinnedEventIds` |pinnedEventIds[] |Object containing the IDs of pinned
38+
events.
39+
|`savedObjectId` |String |The timeline's saved object ID.
3540
|`savedQueryId` |String |If used, the saved query ID used to filter or search
3641
dropzone query results.
37-
|`sort` |Object |Indicates how rows are sorted in the result's grid.
38-
|`status` |String |Ben: ???
39-
|`templateTimelineId` |Ben: ??? |
40-
|`templateTimelineVersion` |Ben: ??? |
41-
|`timelineType` |String |Ben: ????
42+
|`sort` |sort a|Object indicating how rows are sorted in the timeline's grid:
43+
44+
* `columnId` (string): The ID of the column used to sort results.
45+
* `sortDirection` (string): The sort direction, which can be either `desc` or
46+
`asc`.
47+
48+
|`status` |String |: ???
49+
|`templateTimelineId` |String |: ???
50+
|`templateTimelineVersion` |Integer |: ???
51+
|`timelineType` |String a|Indicates whether the timeline is a template or not,
52+
where:
53+
54+
* `default`: Indicates a timeline used to actively investigate events.
55+
* `template`: Indicates a timeline template used with detection rules for
56+
displaying alerts in Timeline.
57+
4258
|`title` |String |The timeline's title.
43-
|`updated` |Float |The last time the timeline was last updated, using a
59+
|`updated` |Float |The last time the timeline was updated, using a
4460
13-digit Epoch timestamp.
4561
|`updatedBy` |String |The user who last updated the timeline.
4662
|`version` |String |The timeline's version.
4763
|==============================================
64+
65+
[[col-obj]]
66+
[discrete]
67+
==== columns object
68+
69+
[width="100%",options="header"]
70+
|==============================================
71+
|Name |Type |Description
72+
73+
|`aggregatable` |Boolean |???
74+
|`category` |String |???
75+
|`columnHeaderType` |String |???
76+
|`description` |String |???
77+
|`example` |String |???
78+
|`indexes` |String |???
79+
|`id` |String |???
80+
|`name` |String |???
81+
|`placeholder` |String |???
82+
|`searchable` |Boolean |???
83+
|`type` |String |???
84+
|==============================================
85+
86+
[[dataProvider-obj]]
87+
[discrete]
88+
==== dataProviders object
89+
90+
[width="100%",options="header"]
91+
|==============================================
92+
|Name |Type |Description
93+
94+
|`id` |String |???
95+
|`name` |String |???
96+
|`enabled` |Boolean |???
97+
|`excluded` |Boolean |???
98+
|`kqlQuery` |String |???
99+
|`queryMatch` |QueryMatchInput |???
100+
|`and` |dataProviders |???
101+
|==============================================
102+
103+
[[eventNotes-obj]]
104+
[discrete]
105+
==== eventNotes object
106+
107+
[width="100%",options="header"]
108+
|==============================================
109+
|Name |Type |Description
110+
111+
|`created` |Float |The time the note was created, using a 13-digit Epoch
112+
timestamp.
113+
|`createdBy` |String |The user who added the note.
114+
|`eventId` |String |The ID of the event to which the note was added.
115+
|`note` |String |The note's text.
116+
|`noteId` |String |The note's ID
117+
|`timelineId` |String |The ID of the timeline to which the note was added.
118+
|`updated` |Float |The last time the note was updated, using a
119+
13-digit Epoch timestamp.
120+
|`updatedBy` |String |The user who last updated the note.
121+
|`version` |String |The note's version.
122+
|==============================================
123+
124+
[[favorite-obj]]
125+
[discrete]
126+
==== favorite object
127+
128+
[width="100%",options="header"]
129+
|==============================================
130+
|Name |Type |Description
131+
132+
|`favoriteDate` |Float |The time the timeline was marked as a favorite.
133+
|`fullName` |String |The full name of the user who marked the timeline as
134+
a favorite.
135+
|`keySearch` |String |???
136+
|`userName` |String |The {kib} username of the user who marked the
137+
timeline as a favorite.
138+
|==============================================
139+
140+
[[filters-obj]]
141+
[discrete]
142+
==== filters object
143+
144+
[width="100%",options="header"]
145+
|==============================================
146+
|Name |Type |Description
147+
148+
|`exists` |String |???
149+
|`meta` |FilterMetaTimelineInput |???
150+
|`match_all` |String |???
151+
|`missing` |String |???
152+
|`query` |String |???
153+
|`range` |String |???
154+
|`script` |String |???
155+
|==============================================
156+
157+
[[globalNotes-obj]]
158+
[discrete]
159+
==== globalNotes object
160+
161+
[width="100%",options="header"]
162+
|==============================================
163+
|Name |Type |Description
164+
165+
|`created` |Float |The time the note was created, using a 13-digit Epoch
166+
timestamp.
167+
|`createdBy` |String |The user who added the note.
168+
|`note` |String |The note's text.
169+
|`noteId` |String |The note's ID
170+
|`timelineId` |String |The ID of the timeline to which the note was added.
171+
|`updated` |Float |The last time the note was updated, using a
172+
13-digit Epoch timestamp.
173+
|`updatedBy` |String |The user who last updated the note.
174+
|`version` |String |The note's version.
175+
|==============================================
176+
177+
[[kqlQuery-obj]]
178+
[discrete]
179+
==== kqlQuery object
180+
181+
[width="100%",options="header"]
182+
|==============================================
183+
|Name |Type |Description
184+
185+
|`filterQuery` |filterQuery a|Object containing query details:
186+
187+
* `kuery`: Object containing the query's statements and type:
188+
** `expression`(string): The query's statements.
189+
** `kind` (string): The type of query, which can be `kuery` or `lucene`.
190+
* `serializedQuery` (string): The query represented in JSON format.
191+
|==============================================

0 commit comments

Comments
 (0)