Overview
This endpoint retrieves a paginated list of raw security alerts. Use query parameters to filter, sort, and define a time range for your query. This API is functionally identical to the edr/v2/alerts API but provides an enriched response, such as HostInfo data.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
<HTTPS Method>
GET https://{Trellix EDR_gateway_URL}/edr/v3/alerts
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key> Accept-Encoding: gzip
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.Accept-Encoding: This is an optional header you can include to tell the server you can accept a compressed response (using gzip), which can make the data transfer faster.
Request parameters
Parameters | Data type/Values | Description |
|---|---|---|
sort | string | Specifies the order (ascending/descending) for the returned results. |
from | integer | Sets the start of the time frame to search, in epoch milliseconds. |
to | integer | Sets the end of the time frame to search, in epoch milliseconds. |
filter | string | Narrows down results based on criteria like severity, name, or rank. |
page[offset] | integer | Skips a specified number of records; used for pagination. |
page[limit] | integer | Sets the maximum number of records to return per page. |
Response
Response parameters
Parameters | Data type | Description |
|---|---|---|
Trace_Id | string | Autogenerated GUID for the event. |
Parent_Trace_Id | string | TraceId of the parent process event. |
Root_Trace_Id | string | Root trace ID of the entire process group. |
DetectionDate | string | Time of detection in EDR cloud. |
Event_Date | string | Earliest timestamp from related traces (endpoint clock, UTC). |
Activity | string | Evet type |
Severity | string (enum: s0–s5) | BANF rule severity. For details, see Security levels. |
Score | integer | BANF rule confidence score. |
Detection_Tags | array[string] | MITRE ATT&CK tactic and technique IDs. |
Related_Trace_Id | array[string] | TraceIds of events responsible for the detection. |
RuleId | string | BANF rule ID that triggered the alert. |
Rank | integer | TA calculated rank |
Pid | integer | Process ID |
Version | string | Version information |
Parents_Trace_Id | array[string] | TraceIds of all ancestor processes (first = parentTraceId). |
ProcessName | string | Name of the process that triggered the rule. |
User | object | User name and domain: { |
CommandLine | string | Full command line of the triggering process. |
Hash_Id | string | Detection ID — identical across identical detections (same data, different date/traceId). |
Host_OS | string | Host OS: windows, linux, or mac. |
Host_Name | string | Host name of the device. |
MAGUID | string | Endpoint MA (formerly McAfee Agent) GUID — uniquely identifies the device. |
Artifact | string | Event artifact type |
HostInfo | string | Serialized host information including network interfaces and OS details. For example, |
Response example
{
"type": "alerts",
"id": "01c0a61a-060a-28e4-002a-7003f431c7aa.fb76269dfabf4fd08385b195064083fa",
"attributes": {
"Severity": "s0",
"Parent_Process_Path": "/usr/bin/bash",
"Process_Integrity": "0.0",
"HostInfo": "{ifaces=[{ip=10.26.3.39, mac=00:50:56:AC:80:A3, name=, type=0.0}, {ip=, mac=, name=Primary, type=0.0}], os={build=0.0, desc=Linux, major=6.0, minor=4.0, sp=0-150600.23.22-default}}",
"Root_Trace_Id": "fee3fc1b-5fc4-4275-b11b-b55f078ae53b",
"Related_Trace_Id": [
"56cfd2c2-018a-4aca-aa70-d983dd6a7f0e"
],
"Process_Sha256": "81b443c0c5053c0b1124f6ad2474a7e256d9d58ca23d6e533e721a5b90c43479",
"Hash_Id": "j5bX9WlAb2jI/Clfo47ESA==",
"Parent_Process_MD5": "6a61aa11781ccf7ee3a31ce111cb73f4",
"Parents_Trace_Id": [
"b1ed287d-6c28-4762-85a3-7643e93e5490",
"e9cacc53-6100-4a0f-a1dd-a874dcad91b5",
"fee3fc1b-5fc4-4275-b11b-b55f078ae53b",
"00f8900c-911c-4bf8-9a24-111190de3901",
"7968480a-d3da-4e43-9c8d-7b710af4988f",
"96d5fd2e-e69d-4576-89aa-17a7f21bbc05",
"00000000-0000-0000-0000-000000000000"
],
"Detection_Tags": [
"@ATA.DefenseEvasion",
"@ATE.T1070.004",
"@MSI._process_file_remove"
],
"Process_Path": "/usr/lib/cron/run-crons",
"HX_Agent_Id": "3t8gXjwtzaebzEOsqzdTrP",
"CommandLine": "/usr/lib/cron/run-crons",
"P_Parent_TraceId": "e9cacc53-6100-4a0f-a1dd-a874dcad91b5",
"Rank": 30,
"Pid": 23502,
"Parent_Process_Name": "bash",
"Host_Name": "82ZSUSE15SP6",
"DetectionDate": "2025-11-10T05:50:41.464+00:00",
"ProcessName": "run-crons",
"Parent_Process_Sha256": "5148d2d56a9635b925392e4943e2da9a38fcd29e722d3b598e0d656a4fecc19f",
"Trace_Id": "a533a1d0-8a06-4a79-8e40-0e6ff3a0088c",
"MAGUID": "1EE2B999-5AA0-F011-87C6-005056AC80A3",
"Version": "undefined",
"Parent_Process_CmdLine": "/bin/sh -c test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1",
"Process_Md5": "878e7ab69c2245e097807ee5c8fbaf50",
"Event_Date": "2025-11-10T05:45:01.000Z",
"Host_OS": "linux",
"Artifact": "Threat",
"Parent_Trace_Id": "b1ed287d-6c28-4762-85a3-7643e93e5490",
"Score": 30,
"User": {
"domain": "",
"name": "root"
},
"Activity": "Threat Detected",
"RuleId": "_process_file_remove"
}
}Response codes
Status | Response | Description |
|---|---|---|
200 | OK | Your request was processed successfully. The server has returned the requested data. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |