Skip to content

Guides

/

Connectors

/

/

EDR Accessed Provider Endpoints
Copy for LLM
Copy page as Markdown for LLMs
View as Markdown
Open this page as Markdown
Open in ChatGPT
Get insights from ChatGPT
Open in Claude
Get insights from Claude

CrowdStrike Falcon® Insight EDR

Operation	Provider Endpoints
Create IOCs	POST /iocs/entities/indicators/v1
Delete IOCs	DELETE /iocs/entities/indicators/v1
Get Endpoint	GET /devices/entities/devices/v2 GET /devices/queries/devices/v1
Quarantine Endpoints	POST /devices/entities/devices-actions/v2
Query Applications	GET /discover/entities/applications/v1 GET /discover/queries/applications/v1
Query EDR Events	GET /alerts/queries/alerts/v2 POST /alerts/entities/alerts/v2
Query Endpoints	GET /devices/entities/devices/v2 GET /devices/queries/devices/v1
Query IOCs	GET /iocs/entities/indicators/v1 GET /iocs/queries/indicators/v1
Query Posture Score	GET /devices/entities/devices/v2 GET /devices/queries/devices/v1 GET /zero-trust-assessment/entities/assessments/v1 GET /zero-trust-assessment/queries/assessments/v1
Query Threat Events	GET /alerts/queries/alerts/v2 POST /alerts/entities/alerts/v2

Microsoft Defender for Endpoint

Operation	Provider Endpoints
Create IOCs	POST /api/indicators
Delete IOCs	POST /api/indicators/batchdelete
Query Alerts	GET /api/alerts
Query Endpoints	GET /api/machines
Query IOCs	GET /api/indicators
Query Posture Score	GET /api/machines
Query Threat Events	GET /api/incidents

SentinelOne Singularity™ Endpoint

Operation	Provider Endpoints
Create IOCs	POST /web/api/v2.1/threat-intelligence/iocs
Delete IOCs	DELETE /web/api/v2.1/threat-intelligence/iocs
Query Alerts	GET /web/api/v2.1/cloud-detection/alerts
Query Applications	GET /web/api/v2.1/application-management/inventory
Query EDR Events	POST /api/query
Query Endpoints	GET /web/api/v2.1/agents
Query IOCs	GET /web/api/v2.1/threat-intelligence/iocs
Query Threat Events	GET /web/api/v2.1/threats

Tanium EDR

Operation	Provider Endpoints
Query Alerts	GET /plugin/products/threat-response/api/v1/alerts
Query Applications	POST /plugin/products/gateway/graphql
Query Endpoints	POST /plugin/products/gateway/graphql
Query Posture Score	POST /plugin/products/gateway/graphql

Previous page

Next page