The SIEM app is now a part of the Elastic Security solution. Click here to view SIEM documentation for previous releases.
« Create timeline or timeline template Cases API »
Elastic Docs ›Elastic Security Solution [7.9] ›Elastic Security APIs ›Timeline API

Import timelines and timeline templates

edit

Import timelines and timeline templates

edit

Imports timelines and timeline templates from an ndjson file.

If you are updating an existing timeline template, make sure:

  • You specify the relevant template’s unique ID (templateTimelineId).
  • You increment the timeline’s version number (templateTimelineVersion).

Request URL

edit

POST <kibana host>:<port>/api/timeline/_import

The request must include:

  • The Content-Type: multipart/form-data HTTP header.
  • A link to the ndjson file containing the timelines.

For example, using cURL:

curl -X POST "<KibanaURL>/api/timeline/_import"
-u <username>:<password> -H 'kbn-xsrf: true'
-H 'Content-Type: multipart/form-data'
--form "file=@<link to file>"

The relative link to the ndjson file containing the timelines.

Example request

edit

Imports the rules in the timelines_export.ndjson file:

curl -X POST "api/detection_engine/rules/_import"
-H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data'
--form "file=@timelines_export.ndjson"

Response code

edit
200
Indicates a successful call.
« Create timeline or timeline template Cases API »