External DocumentationTo learn more, visit the Trellix EDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Filter | A JSON-encoded string of the filters to apply, based on criteria such as the severity, name, or rank. For Example: |
| From | The start of the time frame to search. |
| Limit | The maximum number of results to return. |
| Offset | The number of results to skip before starting to collect the result set. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Sort | The field to sort the results by. |
| To | The end of the time frame to search. |
Example Output
{
"type": "alerts",
"id": "01c0a61a-060a-28e4-002a-7003f431c7aa.fb76269dfabf4fd08385b195064083fa",
"attributes": {
"Severity": "s0",
"Parent_Process_Path": "/usr/bin/bash",
"Process_Integrity": "0.0",
"HostInfo": "{ifaces=[{ip=10.26.3.39, mac=00:50:56:AC:80:A3, name=, type=0.0}, {ip=, mac=, name=Primary, type=0.0}], os={build=0.0, desc=Linux, major=6.0, minor=4.0, sp=0-150600.23.22-default}}",
"Root_Trace_Id": "fee3fc1b-5fc4-4275-b11b-b55f078ae53b",
"Related_Trace_Id": [
"56cfd2c2-018a-4aca-aa70-d983dd6a7f0e"
],
"Process_Sha256": "81b443c0c5053c0b1124f6ad2474a7e256d9d58ca23d6e533e721a5b90c43479",
"Hash_Id": "j5bX9WlAb2jI/Clfo47ESA==",
"Parent_Process_MD5": "6a61aa11781ccf7ee3a31ce111cb73f4",
"Parents_Trace_Id": [
"b1ed287d-6c28-4762-85a3-7643e93e5490",
"e9cacc53-6100-4a0f-a1dd-a874dcad91b5",
"fee3fc1b-5fc4-4275-b11b-b55f078ae53b",
"00f8900c-911c-4bf8-9a24-111190de3901",
"7968480a-d3da-4e43-9c8d-7b710af4988f",
"96d5fd2e-e69d-4576-89aa-17a7f21bbc05",
"00000000-0000-0000-0000-000000000000"
],
"Detection_Tags": [
"@ATA.DefenseEvasion",
"@ATE.T1070.004",
"@MSI._process_file_remove"
],
"Process_Path": "/usr/lib/cron/run-crons",
"HX_Agent_Id": "3t8gXjwtzaebzEOsqzdTrP",
"CommandLine": "/usr/lib/cron/run-crons",
"P_Parent_TraceId": "e9cacc53-6100-4a0f-a1dd-a874dcad91b5",
"Rank": 30,
"Pid": 23502,
"Parent_Process_Name": "bash",
"Host_Name": "82ZSUSE15SP6",
"DetectionDate": "2025-11-10T05:50:41.464+00:00",
"ProcessName": "run-crons",
"Parent_Process_Sha256": "5148d2d56a9635b925392e4943e2da9a38fcd29e722d3b598e0d656a4fecc19f",
"Trace_Id": "a533a1d0-8a06-4a79-8e40-0e6ff3a0088c",
"MAGUID": "1EE2B999-5AA0-F011-87C6-005056AC80A3",
"Version": "undefined",
"Parent_Process_CmdLine": "/bin/sh -c test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1",
"Process_Md5": "878e7ab69c2245e097807ee5c8fbaf50",
"Event_Date": "2025-11-10T05:45:01.000Z",
"Host_OS": "linux",
"Artifact": "Threat",
"Parent_Trace_Id": "b1ed287d-6c28-4762-85a3-7643e93e5490",
"Score": 30,
"User": {
"domain": "",
"name": "root"
},
"Activity": "Threat Detected",
"RuleId": "_process_file_remove"
}
}
Workflow Library Example
List Alerts with Trellix Edr and Send Results Via Email