Get Reaction

Overview

This endpoint retrieves a paginated list of reactions available in the environment. Use query parameters such as page[offset], page[limit], and sort to navigate and organize the results. The response includes both built-in and custom reactions with their configurations. Use this endpoint to view available response actions and identify reaction IDs for automation workflows.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

<HTTPS Method>
GET https://{Trellix EDR_gateway_URL}/edr/v2/reactions

Request

Request headers

Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>

Authorization: This header is used to authenticate your request. You need to replace <your_bearer_token> with the actual token you generate.
Content-Type: This header tells the server that the request body format is json:api. Even though this specific call has no request body, the API requires this header.
x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace <your_api_key> with the key from your onboarding email or the API Access Management page.

Request parameters

Parameters	Data type/Values	Description
page[offset]	Integer	Number of records to skip (starts from 0th record)
page[limit]	Integer	Number of records to fetch in a page
sort	String	Single column to be sorted by. The default sort is ascending.

Response

Response example

{
  "jsonapi": {
    "version": "1.0"
  },
  "meta": {
    "totalResourceCount": 2
  },
  "data": [
    {
      "id": "15",
      "type": "builtinReactions",
      "attributes": {
        "catalogVersion": 1307,
        "metadata": {
          "contentUpdated": false
        },
        "hidden": false,
        "dbVersion": 0,
        "description": "Delete a folder by its full path",
        "classification": "REMEDIATION",
        "timeout": 60,
        "internalArguments": {},
        "internalName": "deleteFolder",
        "remediation": false,
        "task": "REACTION",
        "availableForTrigger": true,
        "name": "DeleteFolder",
        "tenantId": "",
        "arguments": [
          {
            "id": "2924",
            "name": "full_path",
            "type": "STRING",
            "collectorMappings": [
              {
                "id": "3057",
                "name": "Files",
                "output": {
                  "id": "164",
                  "name": "dir",
                  "type": "STRING",
                  "byDefault": false,
                  "sequence": 2
                },
                "type": "BUILTIN",
                "collectorId": 3
              }
            ],
            "optional": false
          }
        ],
        "availableOffline": false,
        "chainedReactions": []
      }
    },
    {
      "id": "554",
      "type": "customReactions",
      "attributes": {
        "catalogVersion": 0,
        "metadata": {},
        "hidden": false,
        "dbVersion": 0,
        "description": "Rebootwindows_powershell",
        "timeout": 30,
        "internalArguments": {},
        "internalName": "_Custom_reaction8",
        "remediation": false,
        "task": "REACTION",
        "availableForTrigger": true,
        "name": "_Custom_reaction8",
        "tenantId": "06ADBB7B-2BD7-4EA7-8380-39C4398BCD3D",
        "arguments": [
          {
            "id": "2873",
            "name": "ip_address1",
            "type": "STRING",
            "collectorMappings": [],
            "optional": false
          },
          {
            "id": "2874",
            "name": "ip_address2",
            "type": "STRING",
            "collectorMappings": [],
            "optional": false
          }
        ],
        "availableOffline": false,
        "chainedReactions": []
      }
    }
  ],
  "links": {
    "self": "/edr/v2/reactions?page[offset]=0&page[limit]=20",
    "first": "/edr/v2/reactions?page[offset]=0&page[limit]=20",
    "prev": null,
    "next": "/edr/v2/reactions?page[offset]=20&page[limit]=20",
    "last": "/edr/v2/reactions?page[offset]=20&page[limit]=20"
  }
}

Response codes

Status	Response	Description
200	OK	Your request was processed successfully. The server has returned the requested data.
400	Bad request	The server couldn't understand your request, likely due to a syntax error or an invalid parameter.