Press CTRL+K to open search

Configure the Historical Search module

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

In the Historical Search page, you must configure the data source to link the module to your EDR Telemetry Store appliance.

  1. Log in to Endpoint Security (HX) On-prem as an administrator.

  2. In the Installed Modules list, locate the Historical Search module.

  3. Click the gear icon for the module and click Configure.

  4. Enter the connection details:

    1. Name: Provide a logical name for the data source.

    2. Server Name: Enter the IP address or FQDN of the EDR Telemetry Store.

      For example, <IP_address> or search.company.com

    3. Port: Enter the port number of the EDR Telemetry Store, the default port number is 9200.

  5. Add the required certificates. These certificates must be copied from the EDR Telemetry Store appliance CLI.

    • To get the certificates:

      1. Connect to the EDR Telemetry Store using SSH and log in.

         ssh admin@<IP_address>

      2. Run the following commands to display the certificates:

        enable
show certificates hxclient

        This command provides three certificate sections that you need to copy and paste into the corresponding field:

        • OpenSearch CA Certificate (Certificate Authority field)

        • HX-Client Certificate (Client Certificate field)

        • HX-Client Private Key (Private Key field)

      3. From the output, copy the entire certificate block.

        Important

        You must include the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

  6. Click Test connection to verify that the settings are correct.

  7. Click Save Settings.

The Historical Search module is connected to the EDR Telemetry Store appliance.

Related articles