The historical search APIs let you query stored endpoint telemetry over a defined time range. Use these endpoints to investigate past activity, hunt for indicators of compromise (IOCs), and reconstruct incident timelines. Historical search queries data that endpoints have already reported.
Endpoints
Endpoint | Description |
|---|---|
Use this to submit a query and start a historical search job. | |
Use this to check whether a search job has finished. | |
Use this to retrieve completed results as paginated JSON. | |
Use this to download the full result set as a CSV file. |
Common reference
All endpoints use the same authentication and request headers. Responses use the s0–s5 severity scale. For details, see Security levels.