diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
index 682ca4c40b17..c141af97b8c4 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
@@ -2140,6 +2140,57 @@
         }
       }
     },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityId}/getTimeline": {
+      "post": {
+        "x-ms-examples": {
+          "Entity timeline": {
+            "$ref": "./examples/entities/timeline/PostTimelineEntity.json"
+          }
+        },
+        "tags": [
+          "Entities"
+        ],
+        "description": "Timeline for an entity.",
+        "operationId": "EntitiesGetTimeline_list",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/EntityId"
+          },
+          {
+            "$ref": "#/parameters/EntityTimelineRequestBody"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/EntityTimelineResponse"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      }
+    },
     "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityId}/relations": {
       "get": {
         "x-ms-examples": {
@@ -6029,6 +6080,37 @@
         }
       }
     },
+    "EntityTimelineParameters": {
+      "description": "The parameters required to execute s timeline operation on the given entity.",
+      "properties": {
+        "kinds": {
+          "description": "Array of timeline Item kinds.",
+          "items": {
+            "$ref": "#/definitions/EntityTimelineKind"
+          },
+          "type": "array"
+        },
+        "startTime": {
+          "description": "The start timeline date, so the results returned are after this date.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "endTime": {
+          "description": "The end timeline date, so the results returned are before this date.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "numberOfBucket": {
+          "description": "The number of bucket for timeline queries aggregation.",
+          "type": "integer",
+          "format": "int32"
+        }
+      },
+      "required": [
+        "startTime",
+        "endTime"
+      ]
+    },
     "EntityExpandResponse": {
       "description": "The entity expansion result operation response.",
       "properties": {
@@ -6051,6 +6133,22 @@
         }
       }
     },
+    "EntityTimelineResponse": {
+      "description": "The entity timeline result operation response.",
+      "properties": {
+        "metaData": {
+          "$ref": "#/definitions/TimelineResultsMetadata",
+          "description": "The metadata from the timeline operation results."
+        },
+        "value": {
+          "description": "The timeline result values.",
+          "items": {
+            "$ref": "#/definitions/EntityTimelineItem"
+          },
+          "type": "array"
+        }
+      }
+    },
     "EntityInnerKind": {
       "description": "The kind of the entity",
       "enum": [
@@ -6294,6 +6392,33 @@
       },
       "type": "object"
     },
+    "EntityTimelineKind": {
+      "description": "The entity query kind",
+      "enum": [
+        "Activity",
+        "Bookmark",
+        "SecurityAlert"
+      ],
+      "type": "string",
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "EntityTimelineKind",
+        "values": [
+          {
+            "description": "activity",
+            "value": "Activity"
+          },
+          {
+            "description": "bookmarks",
+            "value": "Bookmark"
+          },
+          {
+            "description": "security alerts",
+            "value": "SecurityAlert"
+          }
+        ]
+      }
+    },
     "EntityQueryList": {
       "description": "List of all the entity queries.",
       "properties": {
@@ -6395,6 +6520,90 @@
       },
       "type": "object"
     },
+    "TimelineResultsMetadata": {
+      "description": "Expansion result metadata.",
+      "properties": {
+        "totalCount": {
+          "description": "the total items found for the timeline request",
+          "type": "integer",
+          "format": "int32"
+        },
+        "aggregations": {
+          "description": "timeline aggregation per kind",
+          "items": {
+            "$ref": "#/definitions/TimelineAggregation"
+          },
+          "type": "array"
+        },
+        "errors": {
+          "description": "information about the failure queries",
+          "items": {
+            "$ref": "#/definitions/TimelineError"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "totalCount",
+        "aggregations"
+      ],
+      "type": "object"
+    },
+    "TimelineError": {
+      "description": "Timeline Query Errors.",
+      "properties": {
+        "kind": {
+          "description": "the query kind",
+          "$ref": "#/definitions/EntityTimelineKind"
+        },
+        "queryId": {
+          "description": "the query id",
+          "type": "string"
+        },
+        "errorMessage": {
+          "description": "the error message",
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind",
+        "errorMessage"
+      ],
+      "type": "object"
+    },
+    "TimelineAggregation": {
+      "description": "timeline aggregation information per kind",
+      "properties": {
+        "count": {
+          "description": "the total items found for a kind",
+          "type": "integer",
+          "format": "int32"
+        },
+        "kind": {
+          "description": "the query kind",
+          "$ref": "#/definitions/EntityTimelineKind"
+        }
+      },
+      "required": [
+        "kind",
+        "count"
+      ],
+      "type": "object"
+    },
+    "EntityTimelineItem": {
+      "description": "Entity timeline Item.",
+      "discriminator": "kind",
+      "type": "object",
+      "properties": {
+        "kind": {
+          "$ref": "#/definitions/EntityTimelineKind",
+          "description": "The entity query kind type."
+        }
+      },
+      "required": [
+        "kind"
+      ]
+    },
     "FileEntity": {
       "allOf": [
         {
@@ -6518,6 +6727,176 @@
       },
       "type": "object"
     },
+    "ActivityTimelineItem": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/EntityTimelineItem"
+        }
+      ],
+      "description": "Represents Activity timeline item.",
+      "properties": {
+        "queryId": {
+          "type": "string",
+          "description": "The activity query id."
+        },
+        "bucketStartTimeUTC": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The grouping bucket start time."
+        },
+        "bucketEndTimeUTC": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The grouping bucket end time."
+        },
+        "firstActivityTimeUTC": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The time of the first activity in the grouping bucket."
+        },
+        "lastActivityTimeUTC": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The time of the last activity in the grouping bucket."
+        },
+        "content": {
+          "type": "string",
+          "description": "The activity timeline content."
+        },
+        "title": {
+          "type": "string",
+          "description": "The activity timeline title."
+        }
+      },
+      "required": [
+        "queryId",
+        "bucketStartTimeUTC",
+        "bucketEndTimeUTC",
+        "firstActivityTimeUTC",
+        "lastActivityTimeUTC",
+        "content",
+        "title"
+      ],
+      "type": "object",
+      "x-ms-discriminator-value": "Activity"
+    },
+    "SecurityAlertTimelineItem": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/EntityTimelineItem"
+        }
+      ],
+      "description": "Represents security alert timeline item.",
+      "properties": {
+        "azureResourceId": {
+          "type": "string",
+          "description": "The alert azure resource id."
+        },
+        "productName": {
+          "type": "string",
+          "description": "The alert product name."
+        },
+        "displayName": {
+          "type": "string",
+          "description": "The alert name."
+        },
+        "severity": {
+          "$ref": "#/definitions/AlertSeverity",
+          "description": "The alert severity."
+        },
+        "endTimeUtc": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The alert end time."
+        },
+        "startTimeUtc": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The alert start time."
+        },
+        "timeGenerated": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The alert generated time."
+        },
+        "alertType": {
+          "type": "string",
+          "description": "The name of the alert type."
+        }
+      },
+      "required": [
+        "azureResourceId",
+        "productName",
+        "displayName",
+        "severity",
+        "endTimeUtc",
+        "startTimeUtc",
+        "timeGenerated",
+        "alertType"
+      ],
+      "type": "object",
+      "x-ms-discriminator-value": "SecurityAlert"
+    },
+    "BookmarkTimelineItem": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/EntityTimelineItem"
+        }
+      ],
+      "description": "Represents bookmark timeline item.",
+      "properties": {
+        "azureResourceId": {
+          "type": "string",
+          "description": "The bookmark azure resource id."
+        },
+        "displayName": {
+          "type": "string",
+          "description": "The bookmark display name."
+        },
+        "notes": {
+          "type": "string",
+          "description": "The notes of the bookmark"
+        },
+        "endTimeUtc": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The bookmark end time."
+        },
+        "startTimeUtc": {
+          "format": "date-time",
+          "type": "string",
+          "description": "TThe bookmark start time."
+        },
+        "eventTime": {
+          "format": "date-time",
+          "type": "string",
+          "description": "The bookmark event time."
+        },
+        "createdBy": {
+          "$ref": "#/definitions/UserInfo",
+          "description": "Describes a user that created the bookmark",
+          "type": "object"
+        },
+        "labels": {
+          "description": "List of labels relevant to this bookmark",
+          "items": {
+            "$ref": "#/definitions/Label"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "azureResourceId",
+        "displayName",
+        "notes",
+        "endTimeUtc",
+        "startTimeUtc",
+        "createdBy",
+        "labels"
+      ],
+      "type": "object",
+      "x-ms-discriminator-value": "Bookmark"
+    },
     "FusionAlertRule": {
       "allOf": [
         {
@@ -10392,6 +10771,16 @@
       },
       "x-ms-parameter-location": "method"
     },
+    "EntityTimelineRequestBody": {
+      "description": "The parameters required to execute an timeline operation on the given entity.",
+      "in": "body",
+      "name": "parameters",
+      "required": true,
+      "schema": {
+        "$ref": "#/definitions/EntityTimelineParameters"
+      },
+      "x-ms-parameter-location": "method"
+    },
     "EntityId": {
       "description": "entity ID",
       "in": "path",
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/timeline/PostTimelineEntity.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/timeline/PostTimelineEntity.json
new file mode 100644
index 000000000000..c242ec21b288
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/timeline/PostTimelineEntity.json
@@ -0,0 +1,68 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
+    "parameters": {
+      "numberOfBucket": 4,
+      "startTime": "2019-04-25T00:00:00.000Z",
+      "endTime": "2019-05-26T00:00:00.000Z"
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "kind": "SecurityAlert",
+            "azureResourceId": "4467341f-fb73-4f99-a9b3-29473532cf5a_bf7c3a2f-b743-6410-3ff0-ec64b5995d50",
+            "productName": "Azure Sentinel",
+            "displayName": "Alert display name",
+            "severity": "Medium",
+            "endTimeUtc": "2020-08-29T23:31:28.02Z",
+            "startTimeUtc": "2020-08-28T23:32:28.01Z",
+            "timeGenerated": "2020-08-29T23:37:25.8136594Z",
+            "alertType": "4467341f-fb73-4f99-a9b3-29473532cf5a_c93bf33e-055e-4972-9e7d-f84fe3fb61ae"
+          },
+          {
+            "kind": "Activity",
+            "queryId": "e0459780-ac9d-4b72-8bd4-fecf6b46a0a1",
+            "bucketStartTimeUTC": "2020-08-29T21:31:28.02Z",
+            "bucketEndTimeUTC": "2020-08-29T23:31:28.02Z",
+            "firstActivityTimeUTC": "2020-08-29T21:35:28.02Z",
+            "lastActivityTimeUTC": "2020-08-29T21:35:28.02Z",
+            "content": "he user has deleted the account 3 time(s)",
+            "title": "The user has deleted an account"
+          }
+        ],
+        "metaData": {
+          "totalCount": 6,
+          "aggregations": [
+            {
+              "count": 4,
+              "kind": "Activity"
+            },
+            {
+              "count": 2,
+              "kind": "SecurityAlert"
+            }
+          ],
+          "errors": [
+            {
+              "kind": "Activity",
+              "queryId": "11067f9f-d6a7-4488-887f-0ba564268879",
+              "errorMessage": "syntax error"
+            },
+            {
+              "kind": "SecurityAlert",
+              "errorMessage": "internal server error"
+            }
+          ]
+        }
+      }
+    }
+  }
+}