The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Query parameters

  • Published on Sep 11, 2026
  • 2 minute(s) read
Prev Next

Parameter

Notes

limit=<unsigned 32>

Limits the number of records returned. The default is 50. The maximum allowed is 10,000.

offset=<unsigned 32>

Used for pagination. Returns the records starting with this offset. Default is 0.

sort=<text>

Sorts the result by the specified field and direction.

See //events for the remaining details of this parameter.

filter=<filter spec list>

Specifies how to filter the events. The Default is no filter. See //events for the remaining details of this parameter.

columns=<text>

A comma separated list of Valid Fields to include in the export. Default is all fields.

Response

The information that is returned is CSV formatted data. Each row of the CSV data is terminated by a newline. The first row is the column header row. The column headers represent the text that is shown in the data grid. For example, field id is returned as Index because that is how it is represented in the Grid area of the Endpoint Security Web UI. The following fields are also available that are not in the Grid area. For a description, see the second table in the Process execution event payload.

  • Created At

  • Enrichment Requested At

  • Updated At

  • UUID

Index,MD5,Agent ID,Event At,Process File Exists,Process Path,PID,Parent Path,Parent PID,File Size in Bytes,Creation Time,Last Accessed Time,Modified Time,Args,Type,Start Time,User,Owner,Is Signed,Attributes,Alerted At,Process File Cert,Signature Verified,Last Status Change Time,Group,Created At,Updated At,Is Prelinked,UUID,Enrichment Status,Enrichment Requested At,Hostname
1,fec3360f7a614480f461936ffa28053a,as1fmN5D81ebiO1pyEAwIe,2023-05-08T17:08:36.298Z,true,/bin/bash,64162,/Library/FireEye/xagt/xagt.app/Contents/MacOS/xagt,64143,1326576,2022-05-26T03:00:45.000Z,2022-05-26T03:00:45.000Z,2022-05-26T03:00:45.000Z,,end,2023-05-08T17:08:36.298Z,root,root,,,,,,2022-05-26T03:00:45.000Z,wheel,2023-05-08T17:08:37.618Z,2023-05-08T17:08:37.618Z,,bb132546-c721-469d-9f09-09151185d545,,,mac-177.eng.fireeye.com
2,b7c999040d80e5bf87886d70d992c51e,dqiMMBJzKWdc8mwjh9H9z8,2023-05-08T17:08:54.367Z,true,C:\Windows\System32\svchost.exe,6192,C:\Windows\System32\services.exe,700,47016,2021-02-25T02:16:17.946Z,2023-05-08T17:08:54.370Z,2021-02-25T02:16:17.961Z,C:\Windows\system32\svchost.exe -k wsappx -p,start,2023-05-08T17:08:54.367Z,NT AUTHORITY\SYSTEM,NT SERVICE\TrustedInstaller,true,Archive,,"{""Issuer"":""C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011"",""Subject"":""C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Publisher"",""Algorithm"":""sha256"",""SerialNumber"":""330000024bb2230a43cd03636200000000024b"",""ExpirationTime"":""2021-01-22T19:26:36.000Z""}",true,,,2023-05-08T17:08:54.770Z,2023-05-08T17:08:54.770Z,,9de2bd7f-4e6e-4312-8023-7ca743c36bd7,,,WIN10-21H1-X86
3,f290d12f0351b56708b3df1ec26cb45b,dqiMMBJzKWdc8mwjh9H9z8,2023-05-08T17:08:54.490Z,true,C:\Windows\System32\backgroundTaskHost.exe,5216,C:\Windows\System32\svchost.exe,828,17728,2021-02-25T02:15:30.696Z,2023-05-08T17:08:54.495Z,2021-02-25T02:15:30.696Z,"""C:\Windows\system32\backgroundTaskHost.exe"" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca",start,2023-05-08T17:08:54.490Z,WIN10-21H1-X86\Administrator,NT SERVICE\TrustedInstaller,true,Archive,,"{""Issuer"":""C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011"",""Subject"":""C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows"",""Algorithm"":""sha256"",""SerialNumber"":""3300000266bd1580efa75cd6d3000000000266"",""ExpirationTime"":""2021-03-03T18:30:39.000Z""}",true,,,2023-05-08T17:08:55.753Z,2023-05-08T17:08:55.753Z,,e386b3f0-36ba-4bc7-b304-ae5839b5d277,,,WIN10-21H1-X86
4,1a72de06cae927d57b91ac9615af8845,as1fmN5D81ebiO1pyEAwIe,2023-05-08T17:09:17.233Z,true,/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared,64141,/sbin/launchd,1,1115024,2022-05-26T03:00:45.000Z,2022-05-26T03:00:45.000Z,2022-05-26T03:00:45.000Z,,end,2023-05-08T17:09:17.233Z,_spotlight,root,,,,,,2022-05-26T03:00:45.000Z,wheel,2023-05-08T17:09:18.495Z,2023-05-08T17:09:18.495Z,,1ee20060-7b8b-4ad9-8344-0ff4f7a1c8df,,,mac-177.eng.fireeye.com
5,d703a5b09060d148e0ae02aa15b55a4c,ouCJEWZo93jbHB00Y8cKxD,2023-05-08T17:11:57.719Z,true,/usr/libexec/nm-dispatcher,12056,/usr/lib/systemd/systemd,1,48840,,2023-05-07T23:12:19.162Z,2020-11-16T16:15:18.000Z,/usr/libexec/nm-dispatcher,start,2023-05-08T17:11:57.719Z,root,root,,,,,,2021-05-05T10:37:23.827Z,root,2023-05-08T17:11:59.165Z,2023-05-08T17:11:59.165Z,false,59eb0f4e-880d-4e9b-ac63-f5960b386595,,,12-centos-79
:
Related articles
  • Query parameters
    Endpoint Security Modules (HX) > Process Tracker Module > Endpoint Security Process Tracker Module User Guide Release 1.3.166 > Accessing Process Tracker data using the API > Module REST API endpoints > API: Get process execution events
  • Query parameters
    Endpoint Security Modules (HX) > Process Tracker Module > Endpoint Security Process Tracker Module User Guide Release 1.3.166 > Accessing Process Tracker data using the API > Module REST API endpoints > API: Get specific process execution event
  • Device Search and Historical Search column name
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Appendixes