Remediate Search Results - BlinkOps Documentation

Run a remediation action on specific rows returned by a previous search. Creates an asynchronous job, and returns its ID.

External DocumentationTo learn more, visit the Trellix EDR documentation.

Basic Parameters

Parameter	Description
Action	The remediation action to run on the search results. For example: `killProcess`. Custom reactions are prefixed with an underscore.
Action Inputs	A JSON array of the name-value pairs required by the action. For example: `[ { “name”: “pid”, “value”: “23451” } ]` The valid names depend on the selected action.
Row IDs	A comma-separated list of the IDs of the search result rows to run the action on.
Search ID	The ID of the search that returned the rows. Can be obtained using the `Create Historical Search` action.
Type	The type of the resource in the request body.

Advanced Parameters

Parameter	Description
MVEDR Source	The region or source of the event data. For Example: `xdrsoar:us-west`.
Trace ID	A tracking header, in the format: `workflow-id:task/step-id`.

Example Output

{
	"data": {
		"type": "searchRemediation",
		"id": "sr-9132",
		"attributes": {
			"success": [
				{
					"status": "200",
					"message": "in-progress"
				}
			],
			"failed": [
				{
					"status": "500",
					"message": "Internal Server Error while submitting the remediation request"
				}
			]
		},
		"links": {
			"self": "/edr/v2/remediation/queue-jobs/sr-9132"
		}
	}
}

Workflow Library Example

Remediate Search Results with Trellix Edr and Send Results Via Email

Preview this Workflow on desktop