> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Threats

Retrieve a list of the threats detected across the managed endpoints.

<Note>
  External Documentation

  To learn more, visit the [Trellix EDR documentation](https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide/page/UUID-d3c280cf-f722-d00d-2680-a54bd12cd491.html).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                                                                                                                                             |
  | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filter           | A JSON-encoded string of the filters to apply, based on criteria such as the severity, name, or rank.<br /><br />**For Example:**<br /><pre><code>\{<br />  "severities": \["s0", "s1"],<br />  "scoreRange": \[30]<br />}</code></pre> |
  | From             | The start of the time frame to search.                                                                                                                                                                                                  |
  | Include          | A comma-separated list of the related resources to include in the response.<br /><br />**For Example:** `detections,affectedhosts`                                                                                                      |
  | Limit            | The maximum number of results to return.                                                                                                                                                                                                |
  | Offset           | The number of results to skip before starting to collect the result set.                                                                                                                                                                |
  | Return All Pages | Automatically fetch all resources, page by page.                                                                                                                                                                                        |
  | Sort             | The field to sort the threats by. Prefix with `-` for a descending order.<br /><br />**For Example:** `-lastDetected`                                                                                                                   |
  | To               | The end of the time frame to search.                                                                                                                                                                                                    |
</div>

## Example Output

```json theme={"dark"}
{
	"jsonapi": {
		"version": "1.0"
	},
	"meta": {
		"totalResourceCount": 84
	},
	"data": [
		{
			"type": "threats",
			"id": "182612",
			"attributes": {
				"aggregationKey": "P_6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17",
				"severity": "s4",
				"rank": 270,
				"score": 70,
				"name": "POWERSHELL_56039776.EXE",
				"type": "pe",
				"status": "new",
				"firstDetected": "2023-08-27T05:34:29Z",
				"lastDetected": "2023-08-27T05:34:29Z",
				"edrUiUrl": "https://xconsole.trellix.com/edr/#/monitoring/#/workspace/2160,TOTAL_THREATS,8112",
				"hashes": {
					"sha256": "6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17",
					"sha1": "D9FBB3BD6269FE3D5F349A7569964DCD1AA229B5",
					"md5": "6FEE39009EA5B1110C5DA6DF2B7BDC43"
				}
			},
			"relationships": {
				"affectedhosts": {
					"data": [
						{
							"type": "affected-hosts",
							"id": "649889",
							"attributes": {
								"detectionsCount": 1,
								"severity": "s4",
								"rank": 270,
								"firstDetected": "2023-08-27T05:34:29Z",
								"host": {
									"os": {},
									"netInterfaces": [],
									"traceExtendedVisibility": 0,
									"hostOs": "",
									"aGuid": "6D0A37A8-B5B7-4414-9444-A2B17721642B"
								}
							}
						}
					],
					"links": {
						"self": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"first": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"prev": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"next": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"last": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100"
					}
				},
				"detections": {
					"data": [
						{
							"type": "detections",
							"id": "652404",
							"attributes": {
								"traceId": "9a718cc6-d8f6-46da-b3cc-fc4dbbd60151",
								"firstDetected": "2023-08-27T05:34:29Z",
								"severity": "s4",
								"rank": 270,
								"tags": [
									"@ATA.PrivilegeEscalation",
									"@ATA.Persistence",
									"@ATE.T1546.012",
									"@MSI._reg_ep0130_imageexecution_high",
									"@ATA.DefenseEvasion",
									"@ATE.T1112"
								],
								"host": {
									"os": {},
									"netInterfaces": [],
									"traceExtendedVisibility": 0,
									"hostOs": "",
									"aGuid": "6D0A37A8-B5B7-4414-9444-A2B17721642B"
								},
								"sha256": "6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17"
							}
						}
					],
					"links": {
						"self": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"first": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"prev": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"next": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"last": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100"
					}
				}
			}
		}
	],
	"links": {
		"self": "/edr/v2/threats?page[offset]=0&page[limit]=1",
		"first": "/edr/v2/threats?page[offset]=0&page[limit]=1",
		"prev": "/edr/v2/threats?page[offset]=0&page[limit]=1",
		"next": "/edr/v2/threats?page[offset]=1&page[limit]=1",
		"last": "/edr/v2/threats?page[offset]=83&page[limit]=1"
	}
}
```

## Workflow Library Example

[List Threats with Trellix Edr and Send Results Via Email](https://library.blinkops.com/workflows/list-threats-with-trellix-edr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-threats-with-trellix-edr-and-send-results-via-email/canvas" />
</div>