External DocumentationTo learn more, visit the Trellix EDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Export | Select to return the results in an exportable file format. |
| Limit | The maximum number of results to return. |
| Offset | The number of results to skip before starting to collect the result set. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Search ID | The ID of the search. Can be obtained using the Create Historical Search action. |
| Sort | The field to sort the results by. |
Example Output
{
"jsonapi": {
"version": "1.0"
},
"meta": {
"totalResourceCount": 5000
},
"data": [
{
"id": "2D80E1F0-E3FD-4EBA-AAE6-BAC2EF2F870C_86e7e5ba-a6d0-4f52-8192-44838d14e03a",
"type": "historicalSearchResults",
"attributes": {
"Context_Trace_Id": "01a99f7c-4906-4226-8f05-2319fc91a8b7",
"Process_Start_Time": "2017-09-29T16:41:43.280Z",
"Pid": 10092,
"Process_Sha1": "771752657259429f516ea092515c6468ee88ea6b",
"ProcessName": "PROD_E2E_43076187.EXE",
"Tags": [
"@AC.ProcessCreated"
],
"DetectionDate": "2021-07-21T10:11:04Z",
"DeviceName": "EDR-20-W10_1",
"Process_Sha256": "bef87c6f64b7b20b49aae71ad3b229a7735a87a047268ecbec618d7c49ae7010",
"Trace_Id": "51ba26ec-286d-11ef-a554-157d81051918",
"MAGUID": "51BA26ED-286D-11EF-A554-157D81051918",
"Integrity": 4,
"Process_MD5": "0845715fedc1d4012911840177d7fc52",
"Artifact": "Process",
"OS": "windows",
"Process_File_Name": "PROD_E2E_43076187.EXE",
"Process_Path": "C:\\\\WINDOWS\\\\SYSTEM32\\\\WINDOWSPOWERSHELL\\\\V1.0\\\\PROD_E2E_43076187.EXE",
"Parent_Trace_Id": "f33712f0-fd5c-4798-985b-3cd751acb06a",
"CommandLine": "xyz.exe",
"Activity": "Process Created",
"Time": "2024-06-12T03:39:05.000+00:00"
}
}
],
"links": {
"self": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=20&page[limit]=100",
"first": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=0&page[limit]=100",
"prev": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=0&page[limit]=100",
"next": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=120&page[limit]=100",
"last": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=4900&page[limit]=100"
}
}
Workflow Library Example
Get Historical Search Result with Trellix Edr and Send Results Via Email