Create Historical Search - BlinkOps Documentation

Create an asynchronous search of the historical telemetry collected from the managed endpoints. Return a search ID to poll with the Get Historical Search Job Status action.

External DocumentationTo learn more, visit the Trellix EDR documentation.

Parameters

Parameter	Description
Agent GUID	The GUID of the agent that uniquely identifies the device to search on.
End Time	The end of the time range to search in.
Export	Select to return the results in an exportable file format.
Max Results	The maximum number of rows to include in the results.
Query	The search query to run. Between `1` and `20000` characters. For example: `DeviceName equals "W7x64" and CommandLine contains "exe"`.
Sort	The column to sort the results by.
Start Time	The start of the time range to search in.
Type	The type of the resource in the request body.

Example Output

{
	"data": {
		"type": "queue-jobs",
		"id": "hs-01b5865f-0905-0572-002a-7003d239d812.346565425a0b6b2b7174aa555f67a043",
		"attributes": {
			"status": "in-progress"
		},
		"links": {
			"self": "/edr/v2/searches/queue-jobs/hs-01b5865f-0905-0572-002a-7003d239d812.346565425a0b6b2b7174aa555f67a043"
		}
	}
}

Workflow Library Example

Create Historical Search with Trellix Edr and Send Results Via Email

Preview this Workflow on desktop