[SIEM] Update readme for timeline apis #67038

angorayc · 2020-05-19T16:39:03Z

Summary

Update readme for timeline's api and remove redundant query params

Export timeline api

POST /api/timeline/_export

Authorization

Type: Basic Auth

username: Your Kibana username

password: Your Kibana password

Request header


Content-Type: application/json

kbn-version: 8.0.0

Request param

file_name ${filename}.ndjson

Request body

{
	ids: [
		${timelineId}
	]
}

Import timeline api

POST /api/timeline/_import

Authorization

Type: Basic Auth

username: Your Kibana username

password: Your Kibana password

Request header


Content-Type: application/json

kbn-version: 8.0.0

Request body

a .ndjson file
(each json in the file should match this format)
example:

{"savedObjectId":"a3002fd0-781b-11ea-85e4-df9002f1452c","version":"WzIzLDFd","columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"dataProviders":[],"description":"tes description","eventType":"all","filters":[{"meta":{"field":null,"negate":false,"alias":null,"disabled":false,"params":"{\"query\":\"MacBook-Pro-de-Gloria.local\"}","type":"phrase","key":"host.name"},"query":"{\"match_phrase\":{\"host.name\":\"MacBook-Pro-de-Gloria.local\"}}","missing":null,"exists":null,"match_all":null,"range":null,"script":null}],"kqlMode":"filter","kqlQuery":{"filterQuery":{"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"host.name\"}}],\"minimum_should_match\":1}}","kuery":{"expression":"host.name: *","kind":"kuery"}}},"title":"Test","dateRange":{"start":1585227005527,"end":1585313405527},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1586187068132,"createdBy":"angela","updated":1586187068132,"updatedBy":"angela","eventNotes":[],"globalNotes":[{"noteId":"a3b4d9d0-781b-11ea-85e4-df9002f1452c","version":"WzI1LDFd","note":"this is a note","timelineId":"a3002fd0-781b-11ea-85e4-df9002f1452c","created":1586187069313,"createdBy":"angela","updated":1586187069313,"updatedBy":"angela"}],"pinnedEventIds":[]}

Response

{"success":true,"success_count":1,"errors":[]}

Get draft timeline api

GET /api/timeline/_draft

Authorization

Type: Basic Auth

username: Your Kibana username

password: Your Kibana password

Request header


Content-Type: application/json

kbn-version: 8.0.0

Request param

timelineType default or template

Response

{
    "data": {
        "persistTimeline": {
            "timeline": {
                "savedObjectId": "ababbd90-99de-11ea-8446-1d7fd9f03ebf",
                "version": "WzM2MiwzXQ==",
                "columns": [
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "@timestamp"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "message"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "event.category"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "event.action"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "host.name"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "source.ip"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "destination.ip"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "user.name"
                    }
                ],
                "dataProviders": [],
                "description": "",
                "eventType": "all",
                "filters": [],
                "kqlMode": "filter",
                "timelineType": "default",
                "kqlQuery": {
                    "filterQuery": null
                },
                "title": "",
                "sort": {
                    "columnId": "@timestamp",
                    "sortDirection": "desc"
                },
                "status": "draft",
                "created": 1589899222908,
                "createdBy": "casetester",
                "updated": 1589899222908,
                "updatedBy": "casetester",
                "templateTimelineId": null,
                "templateTimelineVersion": null,
                "favorite": [],
                "eventIdToNoteIds": [],
                "noteIds": [],
                "notes": [],
                "pinnedEventIds": [],
                "pinnedEventsSaveObject": []
            }
        }
    }
}

Clean draft timeline api

POST /api/timeline/_draft

Authorization

Type: Basic Auth

username: Your Kibana username

password: Your Kibana password

Request header


Content-Type: application/json

kbn-version: 8.0.0

Request body

{
	"timelineType": "default" or "template"
}

Response

{
    "data": {
        "persistTimeline": {
            "timeline": {
                "savedObjectId": "ababbd90-99de-11ea-8446-1d7fd9f03ebf",
                "version": "WzQyMywzXQ==",
                "columns": [
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "@timestamp"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "message"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "event.category"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "event.action"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "host.name"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "source.ip"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "destination.ip"
                    },
                    {
                        "columnHeaderType": "not-filtered",
                        "id": "user.name"
                    }
                ],
                "dataProviders": [],
                "description": "",
                "eventType": "all",
                "filters": [],
                "kqlMode": "filter",
                "timelineType": "default",
                "kqlQuery": {
                    "filterQuery": null
                },
                "title": "",
                "sort": {
                    "columnId": "@timestamp",
                    "sortDirection": "desc"
                },
                "status": "draft",
                "created": 1589903306582,
                "createdBy": "casetester",
                "updated": 1589903306582,
                "updatedBy": "casetester",
                "templateTimelineId": null,
                "templateTimelineVersion": null,
                "favorite": [],
                "eventIdToNoteIds": [],
                "noteIds": [],
                "notes": [],
                "pinnedEventIds": [],
                "pinnedEventsSaveObject": []
            }
        }
    }
}

Checklist

Delete any items that are not applicable to this PR.

~~[ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~
Documentation was added for features that require explanation or tutorials
~~[ ] Unit or functional tests were updated or added to match the most common scenarios~~
~~[ ] This was checked for keyboard-only and screenreader accessibility~~
~~[ ] This renders correctly on smaller devices using a responsive layout. (You can test this in your browser~~
~~[ ] This was checked for cross-browser compatibility, including a check against IE11~~

For maintainers

~~[ ] This was checked for breaking API changes and was labeled appropriately~~

elasticmachine · 2020-05-19T16:39:41Z

Pinging @elastic/siem (Team:SIEM)

angorayc · 2020-05-26T09:43:25Z

@elasticmachine merge upstream

angorayc · 2020-05-28T12:08:10Z

@elasticmachine merge upstream

angorayc · 2020-06-01T16:34:55Z

@elasticmachine merge upstream

angorayc · 2020-06-03T21:45:15Z

@elasticmachine merge upstream

angorayc · 2020-06-08T09:32:37Z

@elasticmachine merge upstream

angorayc · 2020-06-09T10:30:44Z

@elasticmachine merge upstream

x-pack/plugins/security_solution/server/lib/timeline/routes/README.md

stephmilovic · 2020-06-09T13:38:03Z

x-pack/plugins/security_solution/server/lib/timeline/routes/README.md

+##### Request body
+a .ndjson file
+(each json in the file should match this [format](https://github.com/elastic/kibana/blob/master/x-pack/plugins/siem/public/graphql/types.ts#L118-L146))


this link is no good

right, we've change the name of the plugin!!

I'll remove there link here as we are not going to use graphql, might not be a good idea to refer to that.

x-pack/plugins/security_solution/server/lib/timeline/routes/README.md

stephmilovic · 2020-06-09T14:05:16Z

x-pack/plugins/security_solution/server/lib/timeline/routes/README.md

+```json
+{
+	"timelineType": "default" or "template"


if i dont pass a body the error I get is:
"[request body]: Invalid value \"null\" supplied to \"\""
I wish it told me the key timelineType

Thanks for pointing that out!
I have a PR up for fixing that: #65448
I'll make sure this won't happen after the fix.

stephmilovic

Thanks for the update and making the requested changes. LGTM, nice work!

stephmilovic · 2020-06-09T16:19:12Z

@elasticmachine merge upstream

angorayc · 2020-06-25T16:00:48Z

@elasticmachine merge upstream

kibanamachine · 2020-06-25T17:57:35Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 9a9fcb4

Build metrics

✅ unchanged

History

💚 Build #52758 succeeded 090fdba
💔 Build #52726 failed 4b37585
💛 Build #52669 was flaky dc61d7a
💚 Build #52330 succeeded 3fcb5a8
💚 Build #51943 succeeded 4f7c4df

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* update doc * update unit test * remove redundant params * fix types * update readme * update readme Co-authored-by: Elastic Machine <[email protected]>

* update doc * update unit test * remove redundant params * fix types * update readme * update readme Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>

* master: (59 commits) [Lens] Fix broken test (elastic#70117) [SIEM] Import timeline fix (elastic#65448) [SECURITY SOLUTION][INGEST] UX update for ingest manager edit/create datasource for endpoint (elastic#70079) [Telemetry] Collector Schema (elastic#64942) [Endpoint] Add Endpoint empty states for onboarding (elastic#69626) Hide unused resolver buttons (elastic#70112) [Security] `Investigate in Resolver` Timeline Integration (elastic#70111) [Discover] Improve styling of graphs in sidebar (elastic#69440) [Metrics UI] Fix EuiTheme type issue (elastic#69735) skip failing suite (elastic#70104) (elastic#70103) [ENDPOINT] Hide the Timeline Flyout while on the Management Pages (elastic#69998) [SIEM][CASE] Persist callout when dismissed (elastic#68372) [SIEM][Exceptions] - Cleaned up and updated exception list item comment structure (elastic#69532) [Maps] remove indexing state from redux (elastic#69765) Add API integration test for deleting data streams. (elastic#70020) renames SIEM to Security Solution (elastic#70070) Adding saved_objects_page in OSS (elastic#69900) [Lens] Use accordion menus in field list for available and empty fields (elastic#68871) Dynamic uiActions & license support (elastic#68507) [SIEM] Update readme for timeline apis (elastic#67038) ...

…bana into alerting/consumer-based-rbac * 'alerting/consumer-based-rbac' of github.com:gmmorris/kibana: (25 commits) [Lens] Fix broken test (elastic#70117) [SIEM] Import timeline fix (elastic#65448) [SECURITY SOLUTION][INGEST] UX update for ingest manager edit/create datasource for endpoint (elastic#70079) [Telemetry] Collector Schema (elastic#64942) [Endpoint] Add Endpoint empty states for onboarding (elastic#69626) Hide unused resolver buttons (elastic#70112) [Security] `Investigate in Resolver` Timeline Integration (elastic#70111) [Discover] Improve styling of graphs in sidebar (elastic#69440) [Metrics UI] Fix EuiTheme type issue (elastic#69735) skip failing suite (elastic#70104) (elastic#70103) [ENDPOINT] Hide the Timeline Flyout while on the Management Pages (elastic#69998) [SIEM][CASE] Persist callout when dismissed (elastic#68372) [SIEM][Exceptions] - Cleaned up and updated exception list item comment structure (elastic#69532) [Maps] remove indexing state from redux (elastic#69765) Add API integration test for deleting data streams. (elastic#70020) renames SIEM to Security Solution (elastic#70070) Adding saved_objects_page in OSS (elastic#69900) [Lens] Use accordion menus in field list for available and empty fields (elastic#68871) Dynamic uiActions & license support (elastic#68507) [SIEM] Update readme for timeline apis (elastic#67038) ...

elasticmachine · 2021-09-23T14:34:27Z

Pinging @elastic/security-solution (Team: SecuritySolution)

update doc

16abd1f

angorayc requested review from a team as code owners May 19, 2020 16:39

angorayc added v7.8.0 v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:SIEM labels May 19, 2020

update unit test

936139a

angorayc added v7.9.0 v7.8.0 and removed v7.8.0 v7.9.0 labels May 19, 2020

Merge branch 'master' into import-export-doc

c258bb1

Merge branch 'master' into import-export-doc

2a5115a

angorayc added v7.9.0 and removed v7.8.0 labels May 28, 2020

Merge branch 'master' into import-export-doc

2546c43

elasticmachine and others added 5 commits June 3, 2020 14:45

Merge branch 'master' into import-export-doc

43802b5

Merge remote-tracking branch 'upstream/master' into import-export-doc

857d417

remove redundant params

eb9e631

Merge remote-tracking branch 'upstream/master' into import-export-doc

82f4c13

fix types

4f7c4df

Merge branch 'master' into import-export-doc

3fcb5a8

Merge branch 'master' into import-export-doc

dc61d7a

stephmilovic reviewed Jun 9, 2020

View reviewed changes

x-pack/plugins/security_solution/server/lib/timeline/routes/README.md Outdated Show resolved Hide resolved

stephmilovic reviewed Jun 9, 2020

View reviewed changes

x-pack/plugins/security_solution/server/lib/timeline/routes/README.md Outdated Show resolved Hide resolved

stephmilovic reviewed Jun 9, 2020

View reviewed changes

angorayc added 2 commits June 9, 2020 15:37

update readme

2f09020

update readme

4b37585

stephmilovic approved these changes Jun 9, 2020

View reviewed changes

Merge branch 'master' into import-export-doc

090fdba

Merge branch 'master' into import-export-doc

9a9fcb4

angorayc merged commit 100a5fd into elastic:master Jun 26, 2020

angorayc mentioned this pull request Jun 26, 2020

[7.x] [SIEM] Update readme for timeline apis (#67038) #70094

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM] Update readme for timeline apis #67038

[SIEM] Update readme for timeline apis #67038

angorayc commented May 19, 2020 •

edited

Loading

elasticmachine commented May 19, 2020

angorayc commented May 26, 2020

angorayc commented May 28, 2020

angorayc commented Jun 1, 2020

angorayc commented Jun 3, 2020

angorayc commented Jun 8, 2020

angorayc commented Jun 9, 2020

stephmilovic Jun 9, 2020

angorayc Jun 9, 2020

angorayc Jun 9, 2020

stephmilovic Jun 9, 2020

angorayc Jun 9, 2020

stephmilovic left a comment

stephmilovic commented Jun 9, 2020

angorayc commented Jun 25, 2020

kibanamachine commented Jun 25, 2020

elasticmachine commented Sep 23, 2021

[SIEM] Update readme for timeline apis #67038

[SIEM] Update readme for timeline apis #67038

Conversation

angorayc commented May 19, 2020 • edited Loading

Summary

Export timeline api

POST /api/timeline/_export

Authorization

Request header

Request param

Request body

Import timeline api

POST /api/timeline/_import

Authorization

Request header

Request body

Response

Get draft timeline api

GET /api/timeline/_draft

Authorization

Request header

Request param

Response

Clean draft timeline api

POST /api/timeline/_draft

Authorization

Request header

Request body

Response

Checklist

For maintainers

elasticmachine commented May 19, 2020

angorayc commented May 26, 2020

angorayc commented May 28, 2020

angorayc commented Jun 1, 2020

angorayc commented Jun 3, 2020

angorayc commented Jun 8, 2020

angorayc commented Jun 9, 2020

stephmilovic Jun 9, 2020

Choose a reason for hiding this comment

angorayc Jun 9, 2020

Choose a reason for hiding this comment

angorayc Jun 9, 2020

Choose a reason for hiding this comment

stephmilovic Jun 9, 2020

Choose a reason for hiding this comment

angorayc Jun 9, 2020

Choose a reason for hiding this comment

stephmilovic left a comment

Choose a reason for hiding this comment

stephmilovic commented Jun 9, 2020

angorayc commented Jun 25, 2020

kibanamachine commented Jun 25, 2020

💚 Build Succeeded

Build metrics

History

elasticmachine commented Sep 23, 2021

angorayc commented May 19, 2020 •

edited

Loading