{
  "info": {
    "_postman_id": "2fdf4be2-dc8c-4fbd-8319-2e1b080b6de2",
    "name": "Trellix EDR Action History Events API",
    "description": "Endpoint Detection and Response API for advanced threat hunting, investigation, and automated response capabilities. The EDR API supports querying threat data, searching devices, retrieving action history, and executing real-time search and response actions across managed endpoints. Authentication uses OAuth 2.0 client credentials with the soc.act.tg scope.\n\nContact Support:\n Name: Trellix Support",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
    "createdAt": "2026-07-28T03:18:42.000Z",
    "updatedAt": "2026-07-28T03:18:42.000Z",
    "lastUpdatedBy": "35240",
    "uid": "35240-2fdf4be2-dc8c-4fbd-8319-2e1b080b6de2"
  },
  "item": [
    {
      "name": "epo",
      "item": [
        {
          "name": "v2",
          "item": [
            {
              "name": "events",
              "item": [
                {
                  "name": "List threat events",
                  "id": "3525aef8-03b3-41e1-9fc8-65c564848a26",
                  "protocolProfileBehavior": {
                    "disableBodyPruning": true
                  },
                  "request": {
                    "method": "GET",
                    "header": [
                      {
                        "key": "Accept",
                        "value": "application/json"
                      }
                    ],
                    "url": {
                      "raw": "{{baseUrl}}/epo/v2/events?limit=25&offset=0&since=<dateTime>&filter=<string>",
                      "host": [
                        "{{baseUrl}}"
                      ],
                      "path": [
                        "epo",
                        "v2",
                        "events"
                      ],
                      "query": [
                        {
                          "description": "Maximum number of items to return per page",
                          "key": "limit",
                          "value": "25"
                        },
                        {
                          "description": "Number of items to skip for pagination",
                          "key": "offset",
                          "value": "0"
                        },
                        {
                          "description": "Return events that occurred after this ISO 8601 timestamp. Maximum lookback is 3 days due to data retention limits.",
                          "key": "since",
                          "value": "<dateTime>"
                        },
                        {
                          "description": "Filter expression to narrow events by attributes such as severity, analyzer name, or agent GUID.",
                          "key": "filter",
                          "value": "<string>"
                        }
                      ]
                    },
                    "description": "Retrieve threat events detected across managed endpoints. Events include malware detections, policy violations, and other security incidents. The data retention period for events is 3 days."
                  },
                  "response": [
                    {
                      "id": "d00a86d1-d12e-4123-beb5-d876695747ba",
                      "name": "Paginated list of threat events",
                      "originalRequest": {
                        "method": "GET",
                        "header": [
                          {
                            "key": "Accept",
                            "value": "application/json"
                          },
                          {
                            "description": "Added as a part of security scheme: bearer",
                            "key": "Authorization",
                            "value": "Bearer <token>"
                          }
                        ],
                        "url": {
                          "raw": "{{baseUrl}}/epo/v2/events?limit=25&offset=0&since=<dateTime>&filter=<string>",
                          "host": [
                            "{{baseUrl}}"
                          ],
                          "path": [
                            "epo",
                            "v2",
                            "events"
                          ],
                          "query": [
                            {
                              "description": "Maximum number of items to return per page",
                              "key": "limit",
                              "value": "25"
                            },
                            {
                              "description": "Number of items to skip for pagination",
                              "key": "offset",
                              "value": "0"
                            },
                            {
                              "description": "Return events that occurred after this ISO 8601 timestamp. Maximum lookback is 3 days due to data retention limits.",
                              "key": "since",
                              "value": "<dateTime>"
                            },
                            {
                              "description": "Filter expression to narrow events by attributes such as severity, analyzer name, or agent GUID.",
                              "key": "filter",
                              "value": "<string>"
                            }
                          ]
                        }
                      },
                      "status": "OK",
                      "code": 200,
                      "_postman_previewlanguage": "json",
                      "header": [
                        {
                          "key": "Content-Type",
                          "value": "application/json"
                        }
                      ],
                      "cookie": [],
                      "responseTime": null,
                      "body": "{\n  \"data\": [\n    {\n      \"id\": \"<string>\",\n      \"type\": \"<string>\",\n      \"attributes\": {\n        \"timestamp\": \"<dateTime>\",\n        \"agentGuid\": \"<uuid>\",\n        \"analyzerName\": \"<string>\",\n        \"analyzerVersion\": \"<string>\",\n        \"threatName\": \"<string>\",\n        \"threatSeverity\": \"<string>\",\n        \"threatCategory\": \"<string>\",\n        \"targetFileName\": \"<string>\",\n        \"targetFilePath\": \"<string>\",\n        \"detectionMethod\": \"<string>\"\n      }\n    },\n    {\n      \"id\": \"<string>\",\n      \"type\": \"<string>\",\n      \"attributes\": {\n        \"timestamp\": \"<dateTime>\",\n        \"agentGuid\": \"<uuid>\",\n        \"analyzerName\": \"<string>\",\n        \"analyzerVersion\": \"<string>\",\n        \"threatName\": \"<string>\",\n        \"threatSeverity\": \"<string>\",\n        \"threatCategory\": \"<string>\",\n        \"targetFileName\": \"<string>\",\n        \"targetFilePath\": \"<string>\",\n        \"detectionMethod\": \"<string>\"\n      }\n    }\n  ],\n  \"meta\": {\n    \"totalItems\": \"<integer>\",\n    \"limit\": \"<integer>\",\n    \"offset\": \"<integer>\"\n  }\n}",
                      "createdAt": "2026-07-28T03:18:42.000Z",
                      "updatedAt": "2026-07-28T03:18:42.000Z",
                      "uid": "35240-d00a86d1-d12e-4123-beb5-d876695747ba"
                    },
                    {
                      "id": "f68bf567-ca37-4a00-9f7e-bebbc76b683b",
                      "name": "Unauthorized - invalid or expired access token",
                      "originalRequest": {
                        "method": "GET",
                        "header": [
                          {
                            "description": "Added as a part of security scheme: bearer",
                            "key": "Authorization",
                            "value": "Bearer <token>"
                          }
                        ],
                        "url": {
                          "raw": "{{baseUrl}}/epo/v2/events?limit=25&offset=0&since=<dateTime>&filter=<string>",
                          "host": [
                            "{{baseUrl}}"
                          ],
                          "path": [
                            "epo",
                            "v2",
                            "events"
                          ],
                          "query": [
                            {
                              "description": "Maximum number of items to return per page",
                              "key": "limit",
                              "value": "25"
                            },
                            {
                              "description": "Number of items to skip for pagination",
                              "key": "offset",
                              "value": "0"
                            },
                            {
                              "description": "Return events that occurred after this ISO 8601 timestamp. Maximum lookback is 3 days due to data retention limits.",
                              "key": "since",
                              "value": "<dateTime>"
                            },
                            {
                              "description": "Filter expression to narrow events by attributes such as severity, analyzer name, or agent GUID.",
                              "key": "filter",
                              "value": "<string>"
                            }
                          ]
                        }
                      },
                      "status": "Unauthorized",
                      "code": 401,
                      "_postman_previewlanguage": "text",
                      "header": [],
                      "cookie": [],
                      "responseTime": null,
                      "body": null,
                      "createdAt": "2026-07-28T03:18:42.000Z",
                      "updatedAt": "2026-07-28T03:18:42.000Z",
                      "uid": "35240-f68bf567-ca37-4a00-9f7e-bebbc76b683b"
                    },
                    {
                      "id": "083c8c91-1457-49c7-b4ec-0e0d58c807b9",
                      "name": "Forbidden - insufficient scope permissions",
                      "originalRequest": {
                        "method": "GET",
                        "header": [
                          {
                            "description": "Added as a part of security scheme: bearer",
                            "key": "Authorization",
                            "value": "Bearer <token>"
                          }
                        ],
                        "url": {
                          "raw": "{{baseUrl}}/epo/v2/events?limit=25&offset=0&since=<dateTime>&filter=<string>",
                          "host": [
                            "{{baseUrl}}"
                          ],
                          "path": [
                            "epo",
                            "v2",
                            "events"
                          ],
                          "query": [
                            {
                              "description": "Maximum number of items to return per page",
                              "key": "limit",
                              "value": "25"
                            },
                            {
                              "description": "Number of items to skip for pagination",
                              "key": "offset",
                              "value": "0"
                            },
                            {
                              "description": "Return events that occurred after this ISO 8601 timestamp. Maximum lookback is 3 days due to data retention limits.",
                              "key": "since",
                              "value": "<dateTime>"
                            },
                            {
                              "description": "Filter expression to narrow events by attributes such as severity, analyzer name, or agent GUID.",
                              "key": "filter",
                              "value": "<string>"
                            }
                          ]
                        }
                      },
                      "status": "Forbidden",
                      "code": 403,
                      "_postman_previewlanguage": "text",
                      "header": [],
                      "cookie": [],
                      "responseTime": null,
                      "body": null,
                      "createdAt": "2026-07-28T03:18:42.000Z",
                      "updatedAt": "2026-07-28T03:18:42.000Z",
                      "uid": "35240-083c8c91-1457-49c7-b4ec-0e0d58c807b9"
                    }
                  ],
                  "createdAt": "2026-07-28T03:18:42.000Z",
                  "updatedAt": "2026-07-28T03:18:42.000Z",
                  "uid": "35240-3525aef8-03b3-41e1-9fc8-65c564848a26"
                }
              ],
              "id": "1fde965b-7fea-43b6-bbea-a1dfea62491d",
              "createdAt": "2026-07-28T03:18:42.000Z",
              "updatedAt": "2026-07-28T03:18:42.000Z",
              "uid": "35240-1fde965b-7fea-43b6-bbea-a1dfea62491d"
            }
          ],
          "id": "f874cb70-f80b-434d-a909-45ae5ffbbc4b",
          "createdAt": "2026-07-28T03:18:42.000Z",
          "updatedAt": "2026-07-28T03:18:42.000Z",
          "uid": "35240-f874cb70-f80b-434d-a909-45ae5ffbbc4b"
        }
      ],
      "id": "306e0cad-a3ea-4cf9-bd80-81ec49558624",
      "createdAt": "2026-07-28T03:18:42.000Z",
      "updatedAt": "2026-07-28T03:18:42.000Z",
      "uid": "35240-306e0cad-a3ea-4cf9-bd80-81ec49558624"
    }
  ],
  "auth": {
    "type": "bearer",
    "bearer": [
      {
        "key": "token",
        "value": "{{bearerToken}}",
        "type": "string"
      }
    ]
  },
  "variable": [
    {
      "key": "baseUrl",
      "value": "https://api.manage.trellix.com"
    }
  ]
}