Overview
This endpoint creates an asynchronous remediation job based on specific results from a previous search. Provide a searchId, the target rowIds , and the action to perform. The API returns a job ID for tracking the outcome. Use this API to complete a "hunt and respond" workflow. After searching to identify endpoints exhibiting specific behavior, use this endpoint to take immediate action on those findings. This API directly connects detection with response, enabling remediation based on live search results, not just pre-defined threat signatures.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
POST https://{Trellix EDR_gateway_URL}/edr/v2/remediation/search
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key> X-MVEDR-Source: <source_region> X-Trace-Id: <trace_id_value>
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.X-MVEDR-Source (Optional): Indicates the region or source of the event data using the format
xdrsoar:<region>. For example,xdrsoar:us-west.X-Trace-Id (Optional): Supports tracking headers trace using the format
workflow-id:task/step-id. For example,execution-id:task/step-id.
Request body
Example 1:
{
"data": {
"type": "searchRemediation",
"attributes": {
"action": "killProcess",
"searchId": "rts-3167",
"rowIds": [
"ff5c00e2fcc56bf166c61dea28a1c8d0",
"385a2b8bb9b533407c996069231c3824"
],
"actionInputs": [
{
"name": "pid",
"value": "23451"
}
]
}
}
}Example 2:
{
"data": {
"type": "searchRemediation",
"attributes": {
"action": "_create_file_win",
"searchId": "rts-342746",
"rowIds": [
"20ed4679fb089e2a6483c0b5198a179c"
],
"actionInputs": [
{
"name": "full_path",
"value": "C:/Users/cdaauto/AppData/Local/Temp/MVAPITest_SR.txt"
}
]
}
}
}Request parameters
There are no request parameters.
Response
Response example
{
"data": {
"type": "searchRemediation",
"id": "sr-9132",
"attributes": {
"success": [
{
"status": "200",
"message": "in-progress"
}
],
"failed": [
{
"status": "500",
"message": "Internal Server Error while submitting the remediation request"
}
]
},
"links": {
"self": "/edr/v2/remediation/queue-jobs/sr-9132"
}
}Response codes
Status | Response | Description |
|---|---|---|
207 | Created | Your request to create a remediation job was accepted and is being processed. The response body will detail which parts of the submission succeeded or failed. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |