The real-time search APIs let you query live data from all connected endpoints — running processes, files, network connections, installed software, and more. Use these endpoints to collect current endpoint state for investigation, threat hunting, or ingestion into an external analysis pipeline.
Endpoints
Endpoint | Description |
|---|---|
Use this to submit a query and start a search job. | |
Use this to check whether a search job has finished. | |
Use this to retrieve completed results as paginated JSON. | |
Download the full result set as a CSV file. |
Common reference
All endpoints use the same authentication and request headers. Responses use the s0–s5 severity scale. For details see, Security levels.