# EDR Accessed Provider Endpoints

## CrowdStrike Falcon® Insight EDR

| Operation | Provider Endpoints |
|  --- | --- |
| Create IOCs | POST /iocs/entities/indicators/v1 |
| Delete IOCs | DELETE /iocs/entities/indicators/v1 |
| Get Endpoint | GET /devices/entities/devices/v2  GET /devices/queries/devices/v1 |
| Quarantine Endpoints | POST /devices/entities/devices-actions/v2 |
| Query Applications | GET /discover/entities/applications/v1  GET /discover/queries/applications/v1 |
| Query EDR Events | GET /alerts/queries/alerts/v2  POST /alerts/entities/alerts/v2 |
| Query Endpoints | GET /devices/entities/devices/v2  GET /devices/queries/devices/v1 |
| Query IOCs | GET /iocs/entities/indicators/v1  GET /iocs/queries/indicators/v1 |
| Query Posture Score | GET /devices/entities/devices/v2  GET /devices/queries/devices/v1  GET /zero-trust-assessment/entities/assessments/v1  GET /zero-trust-assessment/queries/assessments/v1 |
| Query Threat Events | GET /alerts/queries/alerts/v2  POST /alerts/entities/alerts/v2 |


## Microsoft Defender for Endpoint

| Operation | Provider Endpoints |
|  --- | --- |
| Create IOCs | POST /api/indicators |
| Delete IOCs | POST /api/indicators/batchdelete |
| Query Alerts | GET /api/alerts |
| Query Endpoints | GET /api/machines |
| Query IOCs | GET /api/indicators |
| Query Posture Score | GET /api/machines |
| Query Threat Events | GET /api/incidents |


## SentinelOne Singularity™ Endpoint

| Operation | Provider Endpoints |
|  --- | --- |
| Create IOCs | POST /web/api/v2.1/threat-intelligence/iocs |
| Delete IOCs | DELETE /web/api/v2.1/threat-intelligence/iocs |
| Query Alerts | GET /web/api/v2.1/cloud-detection/alerts |
| Query Applications | GET /web/api/v2.1/application-management/inventory |
| Query EDR Events | POST /api/query |
| Query Endpoints | GET /web/api/v2.1/agents |
| Query IOCs | GET /web/api/v2.1/threat-intelligence/iocs |
| Query Threat Events | GET /web/api/v2.1/threats |


## Tanium EDR

| Operation | Provider Endpoints |
|  --- | --- |
| Query Alerts | GET /plugin/products/threat-response/api/v1/alerts |
| Query Applications | POST /plugin/products/gateway/graphql |
| Query Endpoints | POST /plugin/products/gateway/graphql |
| Query Posture Score | POST /plugin/products/gateway/graphql |