Overview
This endpoint retrieves the results of a completed historical search in a paginated JSON:API format. It's designed for applications that need to programmatically process historical data, one page at a time. By providing the search-id and using pagination parameters, you can systematically iterate through the entire result set.
You should use this API when your application needs to programmatically process historical search results record by record. It's the ideal method for integrating historical data into an automated workflow, a custom analytics platform, or for ingesting results into a Security Information and Event Management (SIEM) system without downloading a full file.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
GET https://{Trellix EDR_gateway_URL}/edr/v2/searches/historical/{search-id}/results
Note
You might also find the endpoint in the Location field of the headers tab of the status call's response after the search is finished.
Example — {search-id}: hs-12212
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key> Accept-Encoding: gzip
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.Accept-Encoding: This is an optional header you can include to tell the server you can accept a compressed response (using gzip), which can make the data transfer faster.
Request parameters
Parameters | Data type/Values | Description |
|---|---|---|
searchId | string | Search id of the search in progress. |
page[offset] | integer | Number of records to skip (starts from 0th record). |
page[limit] | integer | Number of records to fetch on a page. |
sort | string | Single column to sort by value. Default sort field: |
export | boolean | Applicable only for specific related historical/device searches. If set to
Default value: |
Accept-Encoding | string | Enable GZIP Compression to return compressed data. Example: gzip, deflate, br |
Response
Response parameters
Parameter | Data type | Description |
|---|---|---|
Time | string | Event timestamp |
DetectionDate | string | Date the event was detected in EDR cloud. |
Activity | string | Activity type |
DeviceName | string | Name of the device. |
CommandLine | string | Full command line of the process. |
ProcessName | string | Name of the process that triggered the event/rule. |
Severity | string | BANF rule severity: potential impact of detection. For details, see Security levels. |
Score | integer | Trellix Agent calculated rank |
RuleId | string | BANF rule ID that triggered the detection. |
Detection_Tags | array[string] | MITRE ATT&CK tags (for example, @ATA.Execution, @ATE.T1059.001) |
Trace_Id | string | Autogenerated GUID for the event. |
Parent_Trace_Id | string | TraceId of the Process Created event for the detection process. |
Root_Trace_Id | string | Root trace ID of the process group for this threat. |
Related_Trace_Id | array[string] | TraceIds representing events responsible for detection. |
Parents_Trace_Id | array[string] | TraceIds of all ancestor processes (first = parentTraceId). |
Hash_Id | string | Detection ID — identical for two detections sharing same data except detectionDate/traceId. |
MAGUID | string | Endpoint MA (formerly McAfee Agent) GUID — uniquely identifies the device. |
Host_Name | string | Host name of the device. |
Host_OS | string | Host OS: windows, linux, or mac |
Artifact | string | Event type (for example, Process, Threat, File) |
Pid | integer | Process ID |
File_Sha256 / Process_Sha256 | string | SHA-256 of file or process image. |
File_MD5 / Process_MD5 | string | MD5 of file or process image. |
File_Sha1 / Process_Sha1 | string | SHA-1 of file or process image. |
Tags | array[string] | Event tags |
User_Name / User | string / object | User associated with the event. Object form: { "domain": "...", "name": "..." } |
Network_Protocol / Network_DstPort / Network_SrcIp / Network_SrcPort | string / integer | Network connection details |
Registry_KeyValue_Path / Registry_KeyValueName / Registry_Key_Name | string | Windows registry event fields |
Api_Name / Api_Arguments / Api_ModuleName | string | API call details |
Service_Name / Service_Path / Service_Type | string | Windows service event fields |
Logon_LogonType / Logon_Name / Logon_Ip | string | Logon event fields |
Process_Path / Process_Start_Time | string | Process path and start time |
OS | string | Operating system |
Event_Date | string | Earliest timestamp for related traces (endpoint clock, UTC) |
Response example
{
"jsonapi": {
"version": "1.0"
},
"meta": {
"totalResourceCount": 5000
},
"data": [
{
"id": "2D80E1F0-E3FD-4EBA-AAE6-BAC2EF2F870C_86e7e5ba-a6d0-4f52-8192-44838d14e03a",
"type": "historicalSearchResults",
"attributes": {
"Context_Trace_Id": "01a99f7c-4906-4226-8f05-2319fc91a8b7",
"Process_Start_Time": "2017-09-29T16:41:43.280Z",
"Pid": 10092,
"Process_Sha1": "771752657259429f516ea092515c6468ee88ea6b",
"ProcessName": "PROD_E2E_43076187.EXE",
"Tags": [
"@AC.ProcessCreated"
],
"DetectionDate": "2021-07-21T10:11:04Z",
"DeviceName": "EDR-20-W10_1",
"Process_Sha256": "bef87c6f64b7b20b49aae71ad3b229a7735a87a047268ecbec618d7c49ae7010",
"Trace_Id": "51ba26ec-286d-11ef-a554-157d81051918",
"MAGUID": "51BA26ED-286D-11EF-A554-157D81051918",
"Integrity": 4,
"Process_MD5": "0845715fedc1d4012911840177d7fc52",
"Artifact": "Process",
"OS": "windows",
"Process_File_Name": "PROD_E2E_43076187.EXE",
"Process_Path": "C:\\\\WINDOWS\\\\SYSTEM32\\\\WINDOWSPOWERSHELL\\\\V1.0\\\\PROD_E2E_43076187.EXE",
"Parent_Trace_Id": "f33712f0-fd5c-4798-985b-3cd751acb06a",
"CommandLine": "xyz.exe",
"Activity": "Process Created",
"Time": "2024-06-12T03:39:05.000+00:00"
}
}
],
"links": {
"self": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=20&page[limit]=100",
"first": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=0&page[limit]=100",
"prev": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=0&page[limit]=100",
"next": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=120&page[limit]=100",
"last": "/edr/v2/searches/historical/hs-01b53d66-0904-c5df-0067-3a0311d594a2.82a69b2e7d17f78748ac706bf4efb8d4/results?page[offset]=4900&page[limit]=100"
}
}Response codes
Status | Response | Description |
|---|---|---|
200 | OK | Your request was processed successfully. The server has returned the requested data. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |