Get result

searchId

string

Search id of the search in progress.

page[offset]

integer

Number of records to skip (starts from 0th record).

page[limit]

integer

Number of records to fetch on a page.

output

string

Defines the search output type.

format

string

Defines the output format.

sort

string

Single column to sort by value. By default, the records are sorted in ascending order. If the records are prefixed with '-', sorted in descending order.

Accept-Encoding

string

Enable GZIP Compression to return compressed data.

Example: gzip, deflate, br

Severity

string (enum: s0–s5)

BANF rule severity: potential impact of detection. For details, see Security levels.

Process_Integrity

string

Process integrity levels for Windows devices.

Root_Trace_Id

string

Root trace ID of the process group (may equal parentTraceId if detected at root process).

Related_Trace_Id

array[string]

List of traceIds representing events responsible for detection.

Process_Sha256

string

SHA-256 hash of the parent process.

Hash_Id

string

Detection ID — identical for two detections sharing same data except detectionDate/traceId.

Parents_Trace_Id

array[string]

traceIds of all ancestor processes (first = parentTraceId).

Detection_Tags

array[string]

MITRE ATT&CK tags (for example, @ATA.Execution, @ATE.T1059.001).

Process_Path, CommandLine

string

Full path and command line of the triggering process.

Rank

integer

Trellix Agent calculated rank, used internally.

Pid

integer

Process ID

Host_Name

string

Host name of the device.

DetectionDate

string (date-time)

Time of detection in EDR cloud.

ProcessName

string

Process initiating events represented by relatedTraceIds that triggered the rule.

Trace_Id

string

Autogenerated GUID for the event.

MAGUID

string

Endpoint MA (formerly McAfee Agent) GUID — uniquely identifies the device.

Version

string

Version information.

Process_Md5

string

MD5 hash of the parent process.

Event_Date

string (date-time)

Earliest timestamp for related traces as reported by the endpoint clock (UTC).

Host_OS

string (enum: windows, linux, mac)

Host OS: windows, linux, or mac.

Artifact

string

Value is Threat for detection events.

Parent_Trace_Id

string

TraceId of the Process Created event for the detection process.

Score

integer

BANF rule score / confidence level.

User

object

User name and domain: { "domain": "...", "name": "..." }.

Activity

string

Type of event

RuleId

string

BANF rule ID that triggered the detection.

Attack_Tags

array[string]

MITRE ATT&CK tactic and technique associations.

HX_Agent_Id

string

HX Agent GUID.

Process_Embed_FileName, Parent_Process_Embed_FileName

string

Embedded filenames of process and grandparent process binaries.

Parent_Process_Path, Parent_Process_CmdLine, Parent_Process_MD5, Parent_Process_Sha256, Parent_Process_Name

string

Grandparent process details (path, command line, hashes, name).

P_Parent_TraceId

string

TraceID of the grandparent process.

HostInfo.os.desc / major / minor / build / sp

string

OS description, major/minor version, build number, service pack.

HostInfo.ifaces.name / mac / ip / type

number

Network interface name, MAC address, IP address, interface type.

200

OK

Your request was processed successfully. The server has returned the requested data.

400

Bad request

The server couldn't understand your request, likely due to a syntax error or an invalid parameter.

401

Access denied request

Your request was rejected because it lacks valid authentication credentials. Check your API key and token.

403

Forbidden

You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions.

404

Not Found

The specific resource or endpoint you requested does not exist.

415

Unsupported Media Type

The server rejected your request because the data format (Content-Type) is not supported.

429

Too Many Requests

You've exceeded the rate limit by sending too many requests in a short period. The Retry-After header in the response will tell you how long to wait before trying again.

500

Internal Server Error

Something went wrong on the server's end. This is not an issue with your request.