{ "info": { "_postman_id": "4ca79df7-5889-430f-9646-d7a4d8f157b6", "name": "Trellix EDR Action History Searches API", "description": "Endpoint Detection and Response API for advanced threat hunting, investigation, and automated response capabilities. The EDR API supports querying threat data, searching devices, retrieving action history, and executing real-time search and response actions across managed endpoints. Authentication uses OAuth 2.0 client credentials with the soc.act.tg scope.\n\nContact Support:\n Name: Trellix Support", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "lastUpdatedBy": "35240", "uid": "35240-4ca79df7-5889-430f-9646-d7a4d8f157b6" }, "item": [ { "name": "edr", "item": [ { "name": "v2", "item": [ { "name": "searches", "item": [ { "name": "{searchId}", "item": [ { "name": "Get search status and results", "id": "ef863979-7d81-4494-90d8-4d58d9e53526", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches/:searchId", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches", ":searchId" ], "variable": [ { "id": "c52d4800-f465-47d7-8d71-25a82411be2d", "key": "searchId", "value": "", "description": "(Required) Unique identifier of the real-time search" } ] }, "description": "Retrieve the current status and results of a real-time search. Results include matching endpoints and the specific indicators that were found during the search." }, "response": [ { "id": "16b37bfd-43a4-4f2c-90c1-d2a5a5c2f8d8", "name": "Search status and results returned", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches/:searchId", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches", ":searchId" ], "variable": [ { "key": "searchId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"status\": \"cancelled\",\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ],\n \"matchCount\": \"\",\n \"createdAt\": \"\",\n \"completedAt\": \"\"\n }\n}", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-16b37bfd-43a4-4f2c-90c1-d2a5a5c2f8d8" }, { "id": "68ff4f3b-1f7f-4637-a30f-a56e0dbc422d", "name": "Unauthorized - invalid or expired access token", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches/:searchId", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches", ":searchId" ], "variable": [ { "key": "searchId" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-68ff4f3b-1f7f-4637-a30f-a56e0dbc422d" }, { "id": "641bd1e4-4338-4dd9-9738-40a5a4ff6ebe", "name": "Search not found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches/:searchId", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches", ":searchId" ], "variable": [ { "key": "searchId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-641bd1e4-4338-4dd9-9738-40a5a4ff6ebe" } ], "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-ef863979-7d81-4494-90d8-4d58d9e53526" } ], "id": "cd905268-c96c-4af6-8c2c-b70043e7d5f7", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-cd905268-c96c-4af6-8c2c-b70043e7d5f7" }, { "name": "Create a real-time search", "id": "18ddbfd8-2596-4e22-9333-90d7954045d3", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/edr/v2/searches", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ] }, "description": "Initiate a real-time search across managed endpoints to hunt for specific indicators of compromise such as file hashes, process names, or network connections. The search runs asynchronously and results are retrieved separately." }, "response": [ { "id": "17039fb3-56c4-4c3c-bb5a-d6f5360273c4", "name": "Search initiated successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/edr/v2/searches", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"status\": \"cancelled\",\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ],\n \"matchCount\": \"\",\n \"createdAt\": \"\",\n \"completedAt\": \"\"\n }\n}", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-17039fb3-56c4-4c3c-bb5a-d6f5360273c4" }, { "id": "45425e23-3a5f-47d7-af43-a5084ec7b698", "name": "Invalid search parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/edr/v2/searches", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-45425e23-3a5f-47d7-af43-a5084ec7b698" }, { "id": "15fdc5bd-048a-4367-a6af-a65b238ee9e8", "name": "Unauthorized - invalid or expired access token", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/edr/v2/searches", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-15fdc5bd-048a-4367-a6af-a65b238ee9e8" } ], "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-18ddbfd8-2596-4e22-9333-90d7954045d3" }, { "name": "List searches", "id": "b89820fa-7ded-427a-baba-9da7d0026436", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches?limit=25&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ], "query": [ { "description": "Maximum number of items to return per page", "key": "limit", "value": "25" }, { "description": "Number of items to skip for pagination", "key": "offset", "value": "0" } ] }, "description": "Retrieve the list of real-time searches and their current execution status." }, "response": [ { "id": "8c0add8d-babc-4382-b222-b5d446e08da3", "name": "Paginated list of searches", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches?limit=25&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ], "query": [ { "description": "Maximum number of items to return per page", "key": "limit", "value": "25" }, { "description": "Number of items to skip for pagination", "key": "offset", "value": "0" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"status\": \"completed\",\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ],\n \"matchCount\": \"\",\n \"createdAt\": \"\",\n \"completedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"status\": \"completed\",\n \"query\": \"\",\n \"targetHosts\": [\n \"\",\n \"\"\n ],\n \"matchCount\": \"\",\n \"createdAt\": \"\",\n \"completedAt\": \"\"\n }\n ],\n \"meta\": {\n \"totalItems\": \"\",\n \"limit\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-8c0add8d-babc-4382-b222-b5d446e08da3" }, { "id": "5a213633-abdc-4511-a42d-10cdbd462484", "name": "Unauthorized - invalid or expired access token", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/edr/v2/searches?limit=25&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "edr", "v2", "searches" ], "query": [ { "description": "Maximum number of items to return per page", "key": "limit", "value": "25" }, { "description": "Number of items to skip for pagination", "key": "offset", "value": "0" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-5a213633-abdc-4511-a42d-10cdbd462484" } ], "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-b89820fa-7ded-427a-baba-9da7d0026436" } ], "id": "aad92e00-78a9-45ef-beed-7ad669e1a186", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-aad92e00-78a9-45ef-beed-7ad669e1a186" } ], "id": "9b6385bb-651f-4552-a126-c74ecaf23f36", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-9b6385bb-651f-4552-a126-c74ecaf23f36" } ], "id": "cd00d4e8-8330-43d1-8f9c-e63bd8d5856e", "createdAt": "2026-07-28T03:18:47.000Z", "updatedAt": "2026-07-28T03:18:47.000Z", "uid": "35240-cd00d4e8-8330-43d1-8f9c-e63bd8d5856e" } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}", "type": "string" } ] }, "variable": [ { "key": "baseUrl", "value": "https://api.manage.trellix.com" } ] }