« 按 templateTimelineId 获取时间线模板 更新时间线或时间线模板 »
Elastic 文档 ›Elastic 安全解决方案 [8.14] ›Elastic 安全 API ›时间线 API

创建时间线或时间线模板

编辑

创建时间线或时间线模板编辑

创建一个新的时间线或时间线模板。

使用 timeline 对象的 timelineType 字段来确定是创建时间线还是时间线模板，其中

  • default 创建一个新的时间线 ("timelineType": "default")
  • template 创建一个新的时间线模板 ("timelineType": "template")

如果未指定 timelineType 字段，则将创建一个新的时间线。

请求 URL编辑

POST <kibana 主机>:<端口>/api/timeline

请求主体编辑

一个 JSON 对象，定义时间线或时间线模板查询和时间过滤器。

有关时间线对象架构及其相应 UI 组件的详细信息，请参阅 时间线架构。

名称 类型 描述 必需

时间线

时间线

时间线对象，定义搜索条件和时间范围。唯一必需的字段是 title。

在创建时间线模板时，请提供这些字段，以便您能够轻松地 导入模板 更新

  • templateTimelineId: 唯一标识符 (UUID，仅适用于时间线模板)
  • templateTimelineVersion: 模板版本号 (仅适用于时间线模板)

是

timelineId

字符串

如果提供，对于新的时间线或模板，必须为 null。

否

版本

字符串

如果提供，对于新的时间线或模板，必须为 null。

否

示例请求编辑

示例 1

创建一个新的时间线。

POST api/timeline
{
  "timeline": {
    "columns": [
      {
        "id": "@timestamp"
      },
      {
        "id": "user.name"
      },
      {
        "id": "event.category"
      },
      {
        "id": "event.action"
      },
      {
        "id": "host.name"
      }
    ],
    "dataProviders": [ 
      {
        "and": [
          {
            "name": "event.category",
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d11",
            "queryMatch": {
              "field": "event.category",
              "value": "process",
              "operator": ":"
            }
          },
          {
            "name": "user.name",
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d12",
            "queryMatch": {
              "field": "user.name",
              "value": "SYSTEM",
              "operator": ":"
            }
          }
        ],
        "enabled": true,
        "excluded": false,
        "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d13",
        "name": "host.os.platform",
        "queryMatch": {
          "field": "host.os.platform",
          "value": "windows",
          "operator": ":"
        }
      }
    ],
    "dateRange": {
      "end": 1594005719000,
      "start": 1593832919000
    },
    "description": "Gets Windows system processes from all hosts",
    "title": "Windows system processes"
  }
}

为了确保时间线在 UI 中正确显示，请在所有 dataProviders 对象中指定这些字段

  • and (可以为空)
  • 名称
  • 启用
  • 排除
  • ID

  • queryMatch

    • 字段
    • 值
    • 运算符

示例 2

创建一个新的时间线模板

POST api/timeline
{
  "timeline": {
    "columns": [
      {
        "id": "@timestamp"
      },
      {
        "id": "user.name"
      },
      {
        "id": "event.category"
      },
      {
        "id": "event.action"
      },
      {
        "id": "host.name"
      }
    ],
    "dataProviders": [
      {
        "and": [
          {
            "name": "event.category",
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d21",
            "queryMatch": {
              "field": "event.category",
              "operator": ":",
              "value": "process" 
            }
          },
          {
            "name": "user.name",
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d22",
            "queryMatch": {
              "field": "user.name",
              "operator": ":",
              "value": "SYSTEM"
            }
          }
        ],
        "enabled": true,
        "excluded": false,
        "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d23",
        "name": "host.os.platform",
        "queryMatch": {
          "field": "host.os.platform",
          "operator": ":",
          "value": "windows"
        }
      }
    ],
    "dateRange": {
      "end": 1594005719000,
      "start": 1593832919000
    },
    "description": "Template for investigating host events",
    "templateTimelineId": "6acb2c90-a01c-11ea-8e47-5dc21077d10c", 
    "templateTimelineVersion": 1, 
    "timelineType": "template", 
    "title": "Host event template"
  }
}

为了确保时间线模板在 UI 中正确显示，请指定 value 字段，即使它在时间线中调查警报时被替换。

模板 UUID。

模板版本号。

要创建模板，timelineType 字段的值必须为 template。

示例 3

创建使用 kqlQuery 对象（UI 中的 KQL 工具栏）的时间线模板，以确保在时间线中调查警报时仅显示 Windows 警报

POST api/timeline
{
  "timeline": {
    "columns": [
      {
        "id": "@timestamp"
      },
      {
        "id": "user.name"
      },
      {
        "id": "event.category"
      },
      {
        "id": "event.action"
      },
      {
        "id": "host.name"
      }
    ],
    "dataProviders": [
      {
        "and": [
          {
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d31",
            "name": "user.name",
            "queryMatch": {
              "field": "user.name",
              "operator": ":",
              "value": "SYSTEM"
            }
          }
        ],
        "enabled": true,
        "excluded": false,
        "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d32",
        "name": "event.category",
        "queryMatch": {
          "field": "event.category",
          "operator": ":",
          "value": "process"
        }
      }
    ],
    "dateRange": {
      "end": 1594005719000,
      "start": 1593832919000
    },
    "description": "Template for investigating Windows events",
    "kqlMode": "filter",
    "kqlQuery": {
      "filterQuery": {
        "kuery": {
          "expression": "host.os.platform : windows",
          "kind": "kuery"
        }
      }
    },
    "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1",
    "templateTimelineVersion": 1,
    "timelineType": "template",
    "title": "Windows event template"
  }
}

响应代码编辑

200
表示成功调用。

响应有效负载编辑

一个 JSON 时间线对象，具有唯一的 savedObjectId 及其 version。

示例 1

时间线响应有效负载

{
  "data": {
    "persistTimeline": {
      "code": 200,
      "message": "success",
      "timeline": {
        "savedObjectId": "7f069820-bf57-11ea-9fcd-ed4e5fd0dcd1",
        "version": "WzQwMiwxXQ==",
        "columns": [
          {
            "id": "@timestamp"
          },
          {
            "id": "user.name"
          },
          {
            "id": "event.category"
          },
          {
            "id": "event.action"
          },
          {
            "id": "host.name"
          }
        ],
        "dataProviders": [
          {
            "and": [
              {
                "name": "event.category",
                "enabled": true,
                "excluded": false,
                "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d41",
                "queryMatch": {
                  "field": "event.category",
                  "value": "process",
                  "operator": ":"
                }
              },
              {
                "name": "user.name",
                "enabled": true,
                "excluded": false,
                "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d42",
                "queryMatch": {
                  "field": "user.name",
                  "value": "SYSTEM",
                  "operator": ":"
                }
              }
            ],
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-914beb92-86ab-471c-a00b-25b7e20c2d43",
            "name": "host.os.platform",
            "queryMatch": {
              "field": "host.os.platform",
              "value": "windows",
              "operator": ":"
            }
          }
        ],
        "dateRange": {
          "end": 1594005719000,
          "start": 1593832919000
        },
        "description": "Gets Windows system processes from all hosts",
        "title": "Windows system processes",
        "created": 1594019310069,
        "createdBy": "elastic",
        "updated": 1594019310069,
        "updatedBy": "elastic",
        "timelineType": "default",
        "status": "active"
      }
    }
  }
}

示例 2

时间线模板响应有效负载

{
  "data": {
    "persistTimeline": {
      "code": 200,
      "message": "success",
      "timeline": {
        "savedObjectId": "75b6cf30-bf82-11ea-9fcd-ed4e5fd0dcd1",
        "version": "WzQ4MiwxXQ==",
        "columns": [
          {
            "id": "@timestamp"
          },
          {
            "id": "user.name"
          },
          {
            "id": "event.category"
          },
          {
            "id": "event.action"
          },
          {
            "id": "host.name"
          }
        ],
        "dataProviders": [
          {
            "and": [
              {
                "enabled": true,
                "excluded": false,
                "id": "timeline-1-43112bd4-3081-491c-b973-605cce4c5f14",
                "name": "user.name",
                "queryMatch": {
                  "field": "user.name",
                  "operator": ":",
                  "value": "SYSTEM"
                }
              }
            ],
            "enabled": true,
            "excluded": false,
            "id": "timeline-1-43112bd4-3081-491c-b973-605cce4c5f15",
            "name": "event.category",
            "queryMatch": {
              "field": "event.category",
              "operator": ":",
              "value": "process"
            }
          }
        ],
        "dateRange": {
          "end": 1594005719000,
          "start": 1593832919000
        },
        "description": "Template for investigating Windows events",
        "kqlMode": "filter",
        "kqlQuery": {
          "filterQuery": {
            "kuery": {
              "expression": "host.os.platform : windows",
              "kind": "kuery"
            }
          }
        },
        "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1",
        "templateTimelineVersion": 1,
        "timelineType": "template",
        "title": "Windows event template",
        "created": 1594037762797,
        "createdBy": "elastic",
        "updated": 1594037762797,
        "updatedBy": "elastic",
        "status": "active"
      }
    }
  }
}
« 按 templateTimelineId 获取时间线模板 更新时间线或时间线模板 »