Overview
This endpoint retrieves the complete results of a finished search and delivers them as a downloadable CSV file. Once a search job has completed, you call this endpoint with the unique search-id and include the output and format query parameters. The API then returns the full dataset from all queried endpoints formatted as a CSV file in the response body.
You should use this API as the final step in a search workflow, after polling the job status endpoint has confirmed that the search is complete. It is the correct endpoint to use when you need to export the entire result set for offline analysis, archiving, or ingestion into other security tools and reporting platforms.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
GET https://{Trellix EDR_gateway_URL}/edr/v2/searches/historical/{search-id}/results?output=file&format=csv
Example — {search-id}: hs-12212
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key> Accept-Encoding: gzip
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.Accept-Encoding: This is an optional header you can include to tell the server you can accept a compressed response (using gzip), which can make the data transfer faster.
Request parameters
Parameters | Data type/Values | Description |
|---|---|---|
page[offset] | Integer | Number of records to skip (starts from 0th record) |
page[limit] | Integer | Number of records to fetch on a page |
output | "file" | Sets the response as a file |
format | "csv" | Sets the export file format to CSV |
Note
If you don't add 'output' and 'format' parameters to the endpoint URL, the results are displayed in the paginated format instead of the file format. For fetching results in the file format, it is mandatory to provide both output and format parameters.
For more details about the Real-time Search APIs, see Trellix Developer Portal.
Response
Response codes
Status | Response | Description |
|---|---|---|
200 | OK | Your request was processed successfully. The server has returned the requested data. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |