To automate the historical search, verify the server connection and then run your historical search queries.
Test the connection
Use connection_test.py to verify the link between the Endpoint Security (HX) and the EDR Telemetry Store server.
This section describes the command-line arguments for the scripts/connection_test.py script.
Argument | Description |
|---|---|
| The URL of the Endpoint Security (HX) server instance. |
| A valid user API token. This method takes precedence over the username and password. |
| The Endpoint Security (HX) username. This is not required if an API token is provided. |
| The Endpoint Security (HX) password. This is not required if an API token is provided. |
| The logging level for the script. Valid values are Default value: |
Examples:
Run the script using an API token: This command verifies the connection using a valid API token.
python scripts/connection_test.py --hxUrl=https://0.0.0.0:3000 --apiToken=IGis7dAPmwNV/U9WAh3qZ5V+lZjZ4T+ROVTCVhp710rTACs=
Run the script using a username and password with debug logging enabled: This command verifies the connection using credentials and enables debug logs.
python scripts/connection_test.py --hxUrl=https://0.0.0.0:3000 --username=user --password=pass123 --logLevel=DEBUG
Run a historical search
Use historical_search.py to run TQL queries.
This section describes the command-line arguments for the scripts/historical_search.py script.
Argument | Description |
|---|---|
| The URL of the Endpoint Security (HX) server instance. |
| A valid user API token. This method takes precedence over the username and password. |
| The Endpoint Security (HX) username. This is not required if an API token is provided. |
| The Endpoint Security (HX) password. This is not required if an API token is provided. |
| The TQL statement for the search query. You must enclose the query string in double quotes ("). |
| The search timeframe in minutes. |
| The exact search start date and time in UTC format:
|
| The exact search end date and time in UTC format:
|
| The logging level for the script. Valid values are Set this to Default value: |
Examples:
Search using API token and relative time: This command runs a search using an API token for specific file hashes within the last 150 minutes.
python scripts/historical_search.py --hxUrl=https://0.0.0.0:3000 --apiToken=IGis7dAPmwNV/U9WAh3qZ5V+lZjZ4T+ROVTCVhp710rTACs= --searchTql="procFileAttrs.md5='8146139c2ad7e550b1d1f49480997446' or procFileAttrs.sha256='207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f'" --relativeTime=150
Search using credentials with relative time: This command runs the same search using a username and password instead of an API token.
python scripts/historical_search.py --hxUrl=https://0.0.0.0:3000 --username=user --password=pass123 --searchTql="procFileAttrs.md5='8146139c2ad7e550b1d1f49480997446' or procFileAttrs.sha256='207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f'" --relativeTime=150
Search using credentials, absolute time, and specific log level: This command runs a search for indicators within a specific UTC date range using basic authentication and limits the output to JSON results.
python scripts/historical_search.py --hxUrl=https://0.0.0.0:3000 --username=user --password=pass123 --searchTql="fileAttributes.md5='8146139c2ad7e550b1d1f49480997446'" --startTime=2025-12-10T10:30:43Z --endTime=2025-12-11T10:30:43Z --logLevel=WARN