You can programmatically run a historical search using Python scripts. These scripts communicate with the Endpoint Security (HX) Historical Search API, allowing you to run the same TQL statements used directly in the console.
Use this package to:
Integrate EDR telemetry into third-party solutions.
Create custom automation workflows.
Develop security orchestration scripts.
For more information about automation, see Historical Search Python Scripts.
Prerequisites
Before you begin, ensure that your environment meets the following requirements:
Python version 3.8 or later is installed on the endpoints.
The Endpoint Security (HX) server is active, with the Historical Search module installed and enabled.
The Historical Search module is configured and connected to the EDR Telemetry Store server.
A valid Endpoint Security (HX) user API token is available for script authentication.
Generate API token
To generate an API token, run the following command:
curl -s -k GET "https://<ip>:3000/hx/api/v3/token" -H "accept: application/json" -i --user admin
Note
The API token is valid for 2.5 hours and expires after 15 minutes of inactivity. To avoid frequent API token renewal, use an API username and password.
For more information about generating tokens, see Access Token.