Trellix Detections API

openapi: 3.2.0
info:
  title: Trellix EDR Action History Detections API
  description: Endpoint Detection and Response API for advanced threat hunting, investigation, and automated response capabilities. The EDR API supports querying threat data, searching devices, retrieving action history, and executing real-time search and response actions across managed endpoints. Authentication uses OAuth 2.0 client credentials with the soc.act.tg scope.
  version: '2.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
  termsOfService: https://www.trellix.com/en-us/about/legal/terms-of-use.html
servers:
- url: https://api.manage.trellix.com
  description: Trellix Cloud Management Platform
security:
- bearerAuth: []
tags:
- name: Detections
  description: Retrieve individual detection events with process names, command lines, hash identifiers, and domain information.
paths:
  /edr/v2/detections:
    get:
      operationId: listDetections
      summary: List detections
      description: Retrieve individual detection events across managed endpoints. Detections include SHA256 hashes, severity rankings, and MITRE ATT&CK technique tags associated with each event.
      tags:
      - Detections
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: since
        in: query
        description: Return detections that occurred after this ISO 8601 timestamp.
        schema:
          type: string
          format: date-time
      - name: threatId
        in: query
        description: Filter detections associated with a specific threat
        schema:
          type: string
      responses:
        '200':
          description: Paginated list of detections
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Detection'
                  meta:
                    $ref: '#/components/schemas/PaginationMeta'
        '401':
          description: Unauthorized - invalid or expired access token
components:
  parameters:
    offset:
      name: offset
      in: query
      description: Number of items to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
    limit:
      name: limit
      in: query
      description: Maximum number of items to return per page
      schema:
        type: integer
        default: 25
        minimum: 1
        maximum: 100
  schemas:
    PaginationMeta:
      type: object
      properties:
        totalItems:
          type: integer
          description: Total number of items matching the query
        limit:
          type: integer
          description: Number of items per page
        offset:
          type: integer
          description: Number of items skipped
    Detection:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the detection
        threatId:
          type: string
          description: Identifier of the parent threat
        sha256:
          type: string
          description: SHA256 hash of the detected file or artifact
        severity:
          type: string
          enum:
          - low
          - medium
          - high
          - critical
          description: Severity ranking of the detection
        processName:
          type: string
          description: Name of the process involved in the detection
        commandLine:
          type: string
          description: Command line arguments of the detected process
        hostName:
          type: string
          description: Hostname of the affected endpoint
        agentGuid:
          type: string
          format: uuid
          description: GUID of the agent that reported the detection
        detectedAt:
          type: string
          format: date-time
          description: Timestamp when the detection occurred
        mitreAttack:
          type: array
          items:
            type: string
          description: MITRE ATT&CK technique tags
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token obtained through the client credentials flow with soc.act.tg scope. Credentials are generated through the Trellix EDR Credential Generator.
externalDocs:
  description: Trellix EDR Product Guide
  url: https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide