External DocumentationTo learn more, visit the Trellix EDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Include | A comma-separated list of the related resources to include in the response. For Example: detections,affectedhosts |
| Threat ID | The ID of the threat. Can be obtained using the List Threats action. |
Example Output
{
"jsonapi": {
"version": "1.0"
},
"meta": {
"totalResourceCount": 1
},
"data": {
"type": "threats",
"id": "182612",
"attributes": {
"aggregationKey": "P_6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17",
"severity": "s4",
"rank": 270,
"score": 70,
"name": "POWERSHELL_56039776.EXE",
"type": "pe",
"status": "new",
"firstDetected": "2023-08-27T05:34:29Z",
"lastDetected": "2023-08-27T05:34:29Z",
"edrUiUrl": "https://xconsole.trellix.com/edr/#/monitoring/#/workspace/2160,TOTAL_THREATS,8112",
"hashes": {
"sha256": "6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17",
"sha1": "D9FBB3BD6269FE3D5F349A7569964DCD1AA229B5",
"md5": "6FEE39009EA5B1110C5DA6DF2B7BDC43"
}
},
"relationships": {
"affectedhosts": {
"data": [
{
"type": "affected-hosts",
"id": "649889",
"attributes": {
"detectionsCount": 1,
"severity": "s4",
"rank": 270,
"firstDetected": "2023-08-27T05:34:29Z",
"host": {
"os": {},
"netInterfaces": [],
"traceExtendedVisibility": 0,
"hostOs": "",
"aGuid": "6D0A37A8-B5B7-4414-9444-A2B17721642B"
}
}
}
],
"links": {
"self": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
"first": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
"prev": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
"next": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
"last": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100"
}
},
"detections": {
"data": [
{
"type": "detections",
"id": "652404",
"attributes": {
"traceId": "9a718cc6-d8f6-46da-b3cc-fc4dbbd60151",
"firstDetected": "2023-08-27T05:34:29Z",
"severity": "s4",
"rank": 270,
"tags": [
"@ATA.DefenseEvasion",
"@ATA.PrivilegeEscalation",
"@MSI._reg_ep0130_imageexecution_high",
"@ATE.T1546.012",
"@ATE.T1112",
"@ATA.Persistence"
],
"host": {
"os": {},
"netInterfaces": [],
"traceExtendedVisibility": 0,
"hostOs": "",
"aGuid": "6D0A37A8-B5B7-4414-9444-A2B17721642B"
},
"sha256": "6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17"
}
}
],
"links": {
"self": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
"first": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
"prev": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
"next": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
"last": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100"
}
}
}
}
}
Workflow Library Example
Get Threat with Trellix Edr and Send Results Via Email