Overview
This endpoint starts an asynchronous search of historical telemetry from managed endpoints. Define the search with a query, startTime, and endTime to receive a job ID for polling status and retrieving results. Use this API to investigate past events and hunt for threats. It is the primary tool for querying historical data to find indicators of compromise (IOCs) or to reconstruct incident timelines.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
POST https://{Trellix EDR_gateway_URL}/edr/v2/searches/historical
You can get the gateway URL from the Trellix on-boarding email. For example, https://api.manage.trellix.com
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key>
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.
Request parameters
Parameters | Data type/Values | Description | |
|---|---|---|---|
query | string | Define the query. | |
startTime and endTime | string | The time period for the results to be fetched. Format:
| |
sort | string | Single column to be sorted by value. Default sort field: Below is the list of allowed values for the sort request parameter:
| |
export | boolean | Applicable only for specific related historical/device searches. If set to
Default value: | |
maxResults | integer | The maximum number of rows to include in the response. Default value: Available values: |
Field | Data type | Description |
|---|---|---|
data.type | string | Must be historicalSearches |
data.attributes.query | string | Search query (1–20000 chars). For example, |
data.attributes.startTime | string (date-time) | Start of time range (ISO 8601) |
data.attributes.endTime | string (date-time) | End of time range (ISO 8601) |
data.attributes.maguid | string (uuid) | The Agent GUID uniquely identifies the device. |
Request example
Example 1: Standard Historical Search
{
"data": {
"type": "historicalSearches",
"attributes": {
"query": "IpAddress contains 10",
"startTime": "2021-07-05",
"endTime": "2021-12-15"
}
}
}Example 2: Device Search with maguid
Note
For Device Search, include the DeviceName collector in the query with an optional maguid parameter.
{
"data": {
"type": "historicalSearches",
"attributes": {
"query": "DeviceName contains DESKTOP",
"startTime": "2021-07-05T02:00:28Z",
"endTime": "2021-12-15T06:00:28Z",
"maguid": "A2C39241-BED9-49F0-BB8B-68F8902EE55C"
}
}
}Response
Response example
{
"data": {
"type": "queue-jobs",
"id": "hs-01b5865f-0905-0572-002a-7003d239d812.346565425a0b6b2b7174aa555f67a043",
"attributes": {
"status": "in-progress"
},
"links": {
"self": "/edr/v2/searches/queue-jobs/hs-01b5865f-0905-0572-002a-7003d239d812.346565425a0b6b2b7174aa555f67a043"
}
}
}Response codes
Status | Response | Description |
|---|---|---|
201 | Created | Your request was successful, and a new resource was created as a result. Your request was successful, and a new resource was created. The response includes details such as the resource ID, which you can use to track or manage the resource. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |