Timeline Commands
listTimelines
Returns all named timelines available for a specific case. Use this command to discover existing timeline names before organizing records into them.
Arguments
case_id
The ID of the case for which to list available timelines.
Required
Outputs
Core.Case.case_id number
The ID of the case.
Core.Case.Timeline.Records.record_id string
The unique ID of the timeline record.
Core.Case.Timeline.Records.record_type string
The type of the timeline record. Possible values: Case activity, Detection, Automation, System update, Response.
Core.Case.Timeline.Records.record_subtype string
The subtype of the timeline record. For example: Note, Playbook started, Case created.
Core.Case.Timeline.Records.record_name string
The name or title of the timeline record.
Core.Case.Timeline.Records.description string
The free-text description or content body of the timeline record.
Core.Case.Timeline.Records.start_ts number
The date and time the record was added to the timeline (record creation time).
Core.Case.Timeline.Records.occurred_at number
The date and time the event actually occurred. This may differ from the record creation time.
Core.Case.Timeline.Records.origin string
The source that created the record. Possible values: User, Automation, System, API Key, AI.
Core.Case.Timeline.Records.origin_id string
The identifier of the source that created the record, for example, the username or automation name.
Core.Case.Timeline.Records.is_evidence boolean
Whether the record is marked as evidence.
Core.Case.Timeline.Records.evidence_title string
The title assigned to the record when it was marked as evidence.
Core.Case.Timeline.Records.evidence_comment string
The comment provided when the record was marked as evidence.
Core.Case.Timeline.Records.evidence_flag_time number
The date and time the record was flagged as evidence.
Core.Case.Timeline.Records.evidence_flag_by string
The user who flagged the record as evidence.
Core.Case.Timeline.Records.timelines string
The named timelines this record belongs to.
Core.Case.Timeline.Records.tags string
The tags attached to this timeline record.
Core.Case.Timeline.Records.is_manual boolean
Whether the record was created manually.
Core.Case.Timeline.Records.attachments unknown
Files attached to this timeline record.
Core.Case.Timeline.Records.xql_execution_id string
The XQL Query Center execution ID linked to this record.
Core.Case.Timeline.Records.xql_data unknown
The XQL query results linked to this record.
Core.Case.Timeline.Metadata.returned_count number
The number of records returned in this response.
Core.Case.Timeline.Metadata.filtered_count number
The number of records matching the applied filters.
Core.Case.Timeline.Metadata.total_count number
The total number of records in the case timeline.
listTimelineRecords
Returns a list of timeline records for a specific case. Multiple filters are combined using AND logic. If no filters are specified, all records are returned.
Arguments
case_id
The ID of the case.
Required
record_id
Filters records by ID (exact match).
Optional
record_type
Filters by record type. Accepts a comma-separated list. Possible values are: Case activity, Detection, Automation, System update, Response.
Optional
record_subtype
Filters by record subtype. Accepts a comma-separated list. Possible values are: Case created, Case assigned, Status changed, Case starred, Case merged, Severity changed, Score changed, Description changed, Name changed, Field updated, Comment added / deleted, Issues grouped, Issues linked to case, Issues unlinked from case, Note added, Issue created, Playbook executed, Response action.
Optional
record_name
Filters by record name (partial match, case-insensitive).
Optional
source
Filters by the source that created the record. Accepts a comma-separated list. Possible values are: User, Automation, System, API Key.
Optional
source_id
Filters by source ID (partial match). For user-created records, this is the username. For automation-created records, this is 'Automation'.
Optional
timelines
Filters by named timeline. Accepts a comma-separated list.
Optional
tags
Filters by tag. Accepts a comma-separated list.
Optional
is_evidence
Filters by evidence status. Set to true to return only evidence records, or false to return only non-evidence records. Possible values are: true, false.
Optional
evidence_comment
Filters by evidence comment (partial match, case-insensitive).
Optional
evidence_flag_time_start_time
Returns records flagged as evidence on or after this date and time. Accepts natural language and ISO 8601 formats, for example, '2 days ago' or '2024-01-15T10:00:00Z'.
Optional
evidence_flag_time_end_time
Returns records flagged as evidence on or before this date and time. Accepts natural language and ISO 8601 formats, for example, '2024-01-15T10:00:00Z'.
Optional
evidence_flag_by
Filters by the user who flagged the record as evidence (partial match, case-insensitive).
Optional
record_creation_time_start_time
Returns records added to the timeline on or after this date and time (record creation time). Accepts natural language and ISO 8601 formats, for example, '2 days ago' or '2024-01-15T10:00:00Z'.
Optional
record_creation_time_end_time
Returns records added to the timeline on or before this date and time (record creation time). Accepts natural language and ISO 8601 formats, for example, '2024-01-15T10:00:00Z'.
Optional
occurred_at_start_time
Returns records with an Occurred At timestamp on or after this date and time. Accepts natural language and ISO 8601 formats, for example, '2 days ago' or '2024-01-15T10:00:00Z'.
Optional
occurred_at_end_time
Returns records with an Occurred At timestamp on or before this date and time. Accepts natural language and ISO 8601 formats, for example, '2024-01-15T10:00:00Z'.
Optional
sort_field
The field to sort results by. Defaults to occurred_at. Possible values are: occurred_at, record_creation_time, record_type, record_subtype, record_name, source, is_evidence. Default is occurred_at.
Optional
sort_order
The sort order for results. Defaults to DESC. Possible values are: ASC, DESC. Default is DESC.
Optional
page
The page number for pagination. Defaults to 0 (the first page). Default is 0.
Optional
limit
The maximum number of records to return per page. Defaults to 50. Default is 50.
Optional
Outputs
Core.Case.case_id number
The ID of the case.
Core.Case.Timeline.Records.record_id string
The unique ID of the timeline record.
Core.Case.Timeline.Records.record_type string
The type of the timeline record. Possible values: Case activity, Detection, Automation, System update, Response.
Core.Case.Timeline.Records.record_subtype string
The subtype of the timeline record. For example: Note, Playbook started, Case created.
Core.Case.Timeline.Records.record_name string
The name or title of the timeline record.
Core.Case.Timeline.Records.description string
The free-text description or content body of the timeline record.
Core.Case.Timeline.Records.start_ts number
The date and time the record was added to the timeline (record creation time).
Core.Case.Timeline.Records.occurred_at number
The date and time the event actually occurred. This may differ from the record creation time.
Core.Case.Timeline.Records.origin string
The source that created the record. Possible values: User, Automation, System, API Key, AI.
Core.Case.Timeline.Records.origin_id string
The identifier of the source that created the record, for example, the username or automation name.
Core.Case.Timeline.Records.is_evidence boolean
Whether the record is marked as evidence.
Core.Case.Timeline.Records.evidence_title string
The title assigned to the record when it was marked as evidence.
Core.Case.Timeline.Records.evidence_comment string
The comment provided when the record was marked as evidence.
Core.Case.Timeline.Records.evidence_flag_time number
The date and time the record was flagged as evidence.
Core.Case.Timeline.Records.evidence_flag_by string
The user who flagged the record as evidence.
Core.Case.Timeline.Records.timelines string
The named timelines this record belongs to.
Core.Case.Timeline.Records.tags string
The tags attached to this timeline record.
Core.Case.Timeline.Records.is_manual boolean
Whether the record was created manually.
Core.Case.Timeline.Records.attachments unknown
Files attached to this timeline record.
Core.Case.Timeline.Records.xql_execution_id string
The XQL Query Center execution ID linked to this record.
Core.Case.Timeline.Records.xql_data unknown
The XQL query results linked to this record.
Core.Case.Timeline.Metadata.returned_count number
The number of records returned in this response.
Core.Case.Timeline.Metadata.filtered_count number
The number of records matching the applied filters.
Core.Case.Timeline.Metadata.total_count number
The total number of records in the case timeline.
listTimelineTags
Returns all distinct tags used across timeline records for a case. Use this command to discover available tags before filtering with listTimelineRecords.
Arguments
case_id
The ID of the case for which to list tags. If omitted, returns tags across all cases.
Optional
Outputs
Core.Case.case_id number
The ID of the case.
Core.Case.Timeline.Records.record_id string
The unique ID of the timeline record.
Core.Case.Timeline.Records.record_type string
The type of the timeline record. Possible values: Case activity, Detection, Automation, System update, Response.
Core.Case.Timeline.Records.record_subtype string
The subtype of the timeline record. For example: Note, Playbook started, Case created.
Core.Case.Timeline.Records.record_name string
The name or title of the timeline record.
Core.Case.Timeline.Records.description string
The free-text description or content body of the timeline record.
Core.Case.Timeline.Records.start_ts number
The date and time the record was added to the timeline (record creation time).
Core.Case.Timeline.Records.occurred_at number
The date and time the event actually occurred. This may differ from the record creation time.
Core.Case.Timeline.Records.origin string
The source that created the record. Possible values: User, Automation, System, API Key, AI.
Core.Case.Timeline.Records.origin_id string
The identifier of the source that created the record, for example, the username or automation name.
Core.Case.Timeline.Records.is_evidence boolean
Whether the record is marked as evidence.
Core.Case.Timeline.Records.evidence_title string
The title assigned to the record when it was marked as evidence.
Core.Case.Timeline.Records.evidence_comment string
The comment provided when the record was marked as evidence.
Core.Case.Timeline.Records.evidence_flag_time number
The date and time the record was flagged as evidence.
Core.Case.Timeline.Records.evidence_flag_by string
The user who flagged the record as evidence.
Core.Case.Timeline.Records.timelines string
The named timelines this record belongs to.
Core.Case.Timeline.Records.tags string
The tags attached to this timeline record.
Core.Case.Timeline.Records.is_manual boolean
Whether the record was created manually.
Core.Case.Timeline.Records.attachments unknown
Files attached to this timeline record.
Core.Case.Timeline.Records.xql_execution_id string
The XQL Query Center execution ID linked to this record.
Core.Case.Timeline.Records.xql_data unknown
The XQL query results linked to this record.
Core.Case.Timeline.Metadata.returned_count number
The number of records returned in this response.
Core.Case.Timeline.Metadata.filtered_count number
The number of records matching the applied filters.
Core.Case.Timeline.Metadata.total_count number
The total number of records in the case timeline.
createTimelineRecord
Creates a manual timeline record for a case. Manual records are always created with the subtype NOTE.
Arguments
case_id
The ID of the case.
Required
record_type
The type of the timeline record. Possible values are: Case activity, Detection, Response.
Required
record_name
The name or title of the timeline record.
Required
occurred_at
The date and time the event actually occurred. Use this to backdate a record. Defaults to the current time if omitted. Accepts natural language and ISO 8601 formats, for example, '2 days ago' or '2024-01-15T10:00:00Z'.
Optional
is_evidence
Whether to mark the record as evidence. Defaults to false. Possible values are: true, false. Default is false.
Optional
evidence_comment
An optional comment to attach when marking the record as evidence. Only used when is_evidence is true.
Optional
tags
A comma-separated list of tags to attach to the record.
Optional
description
A free-text description of the timeline record.
Optional
xql_execution_id
The XQL Query Center execution ID to link to this timeline record.
Optional
entry_id
The War Room file entry ID to attach to this record. The file must already be in the War Room (uploaded by the user or returned by a prior command). Must be used together with file_name.
Optional
file_name
The display name of the file to attach (e.g. 'malware.exe'). Required when entry_id is provided. This name appears in the timeline record and is used for downloading the attachment.
Optional
Outputs
Core.Case.case_id number
The ID of the case.
Core.Case.Timeline.Records.record_id string
The ID of the newly created timeline record.
Core.Case.Timeline.Records.attachment_id string
The UUID of the uploaded attachment.
Core.Case.Timeline.Records.file_name string
The file name of the attachment.
Core.Case.Timeline.Records.file_size number
The file size in bytes.
deleteTimelineRecord
Deletes a manual timeline record from a case. Only manually created records can be deleted.
Arguments
case_id
The ID of the case.
Required
record_id
The ID of the timeline record to delete.
Required
Outputs
Core.Case.Timeline.Records.Success boolean
Success
Core.Case.Timeline.Records.RecordID string
RecordID
Core.Case.Timeline.Records.CaseID number
CaseID
updateTimelineRecordTags
Adds or removes tags on one or more timeline records. Use tags_to_add to append new tags; existing tags are preserved. Use tags_to_remove to remove specific tags; all other existing tags are preserved. Use remove_all to clear all tags from the records. At least one of tags_to_add, tags_to_remove, or remove_all must be provided. case_id is required when tags_to_remove or remove_all is used.
Arguments
record_ids
A comma-separated list of timeline record IDs to update.
Required
case_id
The ID of the case the records belong to. Required when tags_to_remove is used.
Optional
tags_to_add
A comma-separated list of tags to add to the records. Existing tags are preserved. Cannot be used together with remove_all.
Optional
tags_to_remove
A comma-separated list of tags to remove from the records. All other existing tags are preserved. Requires case_id. Cannot be used together with remove_all.
Optional
remove_all
Set to true to remove all tags from the specified records. Cannot be combined with tags_to_add or tags_to_remove. Possible values are: true, false.
Optional
Outputs
Core.Case.Timeline.success boolean
Whether the tag operation completed successfully.
Core.Case.Timeline.is_replace boolean
Indicates whether the existing tags were fully replaced (true) or new tags were appended to the existing ones (false).
linkRecordToTimeline
Assigns one or more timeline records to a named timeline. If the named timeline does not exist, it is created automatically. Existing timeline assignments on the records are preserved. Records are appended to the specified timelines.
Arguments
record_ids
A comma-separated list of timeline record IDs to assign.
Required
timelines
A comma-separated list of named timelines to assign the records to. Timelines that do not exist are created automatically.
Required
Outputs
Core.Case.Timeline.success boolean
Whether the operation completed successfully.
Core.Case.Timeline.is_replace boolean
Indicates whether the existing timeline assignments were fully replaced (true) or new timelines were appended to the existing ones (false).
markTimelineRecordAsEvidence
Marks or unmarks a timeline record as evidence.
Arguments
record_id
The ID of the timeline record to mark or unmark.
Required
is_evidence
Set to true to mark the record as evidence, or false to remove the evidence mark. Possible values are: true, false.
Required
comment
An optional comment to attach when marking the record as evidence. Only used when is_evidence is true.
Optional
Last updated
Was this helpful?