Skip to content

Commit b644fba

Browse files
author
Ben Skelker
committed
starts adding timeline api and object schema
1 parent 4bffdb3 commit b644fba

12 files changed

+177
-6
lines changed

‎docs/siem/detections/api/rules-api-export.asciidoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ exported rules is returned.|No, defaults to `false`.
2222
`export.ndjson`
2323
|==============================================
2424

25-
TIP: When using cURL to export rules to a file, use the `-O` and `-J` options to save the rules to the file name specified in the URL.
25+
TIP: When using cURL to export rules to a file, use the `-O` and `-J` options
26+
to save the rules to the file name specified in the URL.
2627

2728
==== Request body
2829

‎docs/siem/detections/machine-learning/machine-learning.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,4 +75,4 @@ the ECS fields listed in each job description.
7575
NOTE: Some jobs use fields that are not ECS-compliant. These jobs are only
7676
available when you use {beats} to ship data.
7777

78-
include::{stack-docs-root}/docs/en/stack/ml/anomaly-detection/ootb-ml-jobs.asciidoc[tag=siem-jobs]
78+
include::{ml-dir}/anomaly-detection/ootb-ml-jobs.asciidoc[tag=siem-jobs]

‎docs/siem/index.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,4 @@ include::cases/cases-index.asciidoc[]
2626

2727
include::siem-apis.asciidoc[]
2828

29-
include::field-ref.asciidoc[]
29+
include::reference/ref-index.asciidoc[]

‎docs/siem/field-ref.asciidoc‎ renamed to ‎docs/siem/reference/field-ref.asciidoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[[siem-field-reference]]
2-
[chapter, role="xpack"]
3-
= SIEM field reference guide
2+
[role="xpack"]
3+
== SIEM field reference guide
44

55
This section lists ECS fields the {siem-app} uses to display data.
66

‎docs/siem/reference/ref-index.asciidoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
include::ref-intro.asciidoc[]
2+
3+
include::field-ref.asciidoc[]
4+
5+
include::timeline-schema.asciidoc[]

‎docs/siem/reference/ref-intro.asciidoc‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[[siem-ref-intro]]
2+
[role="xpack"]
3+
= SIEM fields and objects
4+
5+
This section lists ECS fields the {siem-app} uses to display data and
6+
{siem-soln} JSON object schemas:
7+
8+
* <<siem-field-reference, ECS fields the {siem-app} uses to display data>>
9+
* <<timeline-object-schema>>

‎docs/siem/reference/timeline-schema.asciidoc‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
[[timeline-object-schema]]
2+
[role="xpack"]
3+
== Timeline object schema
4+
5+
[width="100%",options="header"]
6+
|==============================================
7+
|Name |Type |Description
8+
9+
|`columns` |Object[] |The timeline's displayed columns.
10+
|`created` |Float |The time the timeline was created, using a
11+
13-digit Epoch timestamp.
12+
|`createdBy` |String |The user who created the timeline.
13+
|`dataProviders` |Object[] |The dropzone query.
14+
|`dateRange` |Object |The timeline's range.
15+
|`description` |String |The timeline's description.
16+
|`eventNotes` |Object[] |Ben: ??Notes added to specific events.
17+
|`eventType` |String a|Event types displayed in the timeline, which can be:
18+
19+
* `all`: all events
20+
* `raw`: raw events only
21+
* `signal`: signals only
22+
23+
|`filters` |Object[] |Filters used in addition to the dropzone query.
24+
|`globalNotes` |Object[] |Notes added to the timeline.
25+
|`kqlMode` |String a|Determines whether the dropzone queries are filtered (`and`) or additional search results are displayed (`or`), can be:
26+
27+
* `filter`: filters dropzone query results
28+
* `search`: displays additional search results
29+
30+
|`kqlQuery` |Object |Determines whether additional filters use KQL or Lucene
31+
queries.
32+
|`pinnedEventIds` |Object[] |Pinned events
33+
|`savedObjectId` |String |Saved object ID.
34+
|`savedQueryId` |String |If used, the saved query ID used to filter or search
35+
dropzone query results.
36+
|`sort` |Object |Determines how rows are sorted in the result's grid.
37+
|`templateTimelineId` |Ben: ??? |
38+
|`templateTimelineVersion` |Ben: ??? |
39+
|`timelineType` |String |Ben: ????
40+
|`title` |String |The timeline's title.
41+
|`updated` |Float |The time the timeline was last updated, using a
42+
13-digit Epoch timestamp.
43+
|`updatedBy` |String |The user who last updated the timeline.
44+
|`version` |String |Timeline version.
45+
|==============================================

‎docs/siem/siem-apis.asciidoc‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
You can use these APIs to interface with {siem-soln} features:
66

77
* <<rule-api-overview>>: Manage detection rules and signals
8+
* <<timeline-api-overview>>: Import and export timelines
89
* <<cases-api-overview>>: Open and manage cases
910

1011
Additionally, the {kib} <<actions-api-overview, Actions API>> is partially
@@ -72,6 +73,8 @@ how to work with and disable the random path component.
7273

7374
include::detections/api/det-api-index.asciidoc[]
7475

76+
include::timeline/api/timeline-api-index.asciidoc[]
77+
7578
include::cases/api/cases-api/cases-api-index.asciidoc[]
7679

77-
include::cases/api/actions-api/cases-actions-api-index.asciidoc[]
80+
include::cases/api/actions-api/cases-actions-api-index.asciidoc[]

‎docs/siem/timeline/api/timeline-api-export.asciidoc‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
[[timeline-api-export]]
2+
=== Export timelines
3+
4+
Exports timelines to an ndjson file.
5+
6+
==== Request URL
7+
8+
`POST <kibana host>:<port>/api/timeline/_export`
9+
10+
11+
===== URL query parameters
12+
13+
[width="100%",options="header"]
14+
|==============================================
15+
|Name |Type |Description |Required
16+
17+
|`exclude_export_details` |Boolean |Does not affect the returned file.|Yes
18+
|`file_name` |String |File name for saving the exported rules. |Yes
19+
|==============================================
20+
21+
TIP: When using cURL to export timelines to a file, use the `-O` and `-J`
22+
options to save the timelines to the file name specified in the URL.
23+
24+
==== Request body
25+
26+
A JSON `ids` array containing the `savedObjectId` fields of the rules you want to export:
27+
28+
[width="100%",options="header"]
29+
|==============================================
30+
|Name |Type |Description |Required
31+
32+
|`ids` |String[] |Array of `savedObjectId` fields. |Yes
33+
|==============================================
34+
35+
36+
===== Example request
37+
38+
Exports two timeline and saves them to the `timelines_export.ndjson` file:
39+
40+
[source,console]
41+
--------------------------------------------------
42+
POST api/timeline/_export?exclude_export_details=false&file_name=timelines_export.ndjson
43+
{
44+
"ids": [
45+
"34ca11c0-9503-11ea-9f74-e7e108796192",
46+
"21cf9a00-9048-11ea-9f74-e7e108796192"
47+
]
48+
}
49+
--------------------------------------------------
50+
// KIBANA
51+
52+
53+
==== Response code
54+
55+
`200`::
56+
Indicates a successful call.

‎docs/siem/timeline/api/timeline-api-import.asciidoc‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
[[timeline-api-import]]
2+
=== Import timelines
3+
4+
Imports timelines from an ndjson file.
5+
6+
==== Request URL
7+
8+
`POST <kibana host>:<port>/api/timeline/_import`
9+
10+
The request must include:
11+
12+
* The `Content-Type: multipart/form-data` HTTP header.
13+
* A link to the ndjson file containing the timelines.
14+
15+
For example, using cURL:
16+
17+
[source,console]
18+
--------------------------------------------------
19+
curl -X POST "<KibanaURL>/api/timeline/_import"
20+
-u <username>:<password> -H 'kbn-xsrf: true'
21+
-H 'Content-Type: multipart/form-data'
22+
--form "file=@<link to file>" <1>
23+
--------------------------------------------------
24+
<1> The relative link to the ndjson file containing the timelines.
25+
26+
===== Example request
27+
28+
Imports the rules in the `timelines_export.ndjson` file:
29+
30+
[source,console]
31+
--------------------------------------------------
32+
curl -X POST "api/detection_engine/rules/_import"
33+
-H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data'
34+
--form "file=@timelines_export.ndjson"
35+
--------------------------------------------------
36+
37+
==== Response code
38+
39+
`200`::
40+
Indicates a successful call.

0 commit comments

Comments
 (0)