Skip to content
Connectors
/
/
EDR Connector

Query and interact with endpoint detection and response products.

API Reference

For full API documentation see the EDR API Reference.

To create an integration with the EDR connector, use the Create Integration API endpoint, using one of the provider configs below.

Supported Providers

  • Bitdefender GravityZone EDR (edr_bitdefender)
  • CrowdStrike Falcon® Insight EDR (edr_crowdstrike)
  • ESET Connect (edr_eset_connect)
  • Iru (edr_iru)
  • Microsoft Defender for Endpoint (edr_defender)
  • SentinelOne Singularity™ Endpoint (edr_sentinelone)
  • Sophos Endpoint (edr_sophos)
  • Tanium EDR (edr_tanium)
  • ThreatDown Endpoint Detection & Response (edr_malwarebytes)
  • Trellix Endpoint Security (ENS) (edr_trellix_ens)
  • Trellix ePolicy Orchestrator (edr_trellix)
  • [MOCK] CrowdStrike Falcon® Insight EDR (edr_crowdstrike_mock)

Supported Operators by Provider

APIBitdefender GravityZone EDRCrowdStrike Insight EDR[MOCK] CrowdStrike Insight EDRMicrosoft DefenderESET ConnectIruThreatDown EDRSentinelOne EndpointSophos EndpointTanium EDRTrellix ePOTrellix ENS
query_alerts✅✅✅✅✅✅✅✅✅✅✅❌
query_applications❌✅✅✅❌❌✅✅✅✅❌❌
execute_command❌✅❌❌❌❌❌❌❌❌❌❌
query_edr_events❌✅✅✅❌❌✅✅✅✅❌✅
get_endpoint✅✅✅✅✅✅❌✅✅✅✅✅
query_endpoints✅✅✅✅✅✅✅✅✅✅✅✅
retrieve_file❌✅❌❌❌❌❌❌❌❌❌❌
create_ioa❌✅❌✅❌❌❌✅❌❌❌❌
delete_ioa❌✅❌✅❌❌❌✅❌❌❌❌
query_ioa❌✅❌✅❌❌❌✅❌❌❌❌
create_iocs✅✅❌✅❌❌❌✅❌❌❌❌
delete_iocs✅✅❌✅❌❌❌✅❌❌❌❌
query_iocs✅✅✅✅❌❌❌✅❌❌❌❌
query_posture_score❌✅✅✅❌❌❌❌✅❌❌❌
network_quarantine✅✅❌✅✅❌✅✅✅✅✅❌
execute_remote_script❌✅❌❌❌❌❌❌❌❌❌❌
create_threat_note✅✅❌✅✅❌❌✅❌❌❌❌
get_threat_notes✅✅❌✅✅❌❌✅❌❌❌❌
query_threatevents✅✅✅✅✅❌✅✅✅✅✅✅

APIs with Filters

APIBitdefender GravityZone EDRCrowdStrike Insight EDR[MOCK] CrowdStrike Insight EDRMicrosoft DefenderESET ConnectIruThreatDown EDRSentinelOne EndpointSophos EndpointTanium EDRTrellix ePOTrellix ENS
query_alerts✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]❌
query_applications❌✅ [docs]✅ [docs]✅ [docs]❌❌✅ [docs]✅ [docs]✅ [docs]✅ [docs]❌❌
query_edr_events❌✅ [docs]✅ [docs]✅ [docs]❌❌✅ [docs]✅ [docs]✅ [docs]✅ [docs]❌✅ [docs]
query_endpoints✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]
query_ioa❌✅ [docs]❌✅ [docs]❌❌❌✅ [docs]❌❌❌❌
query_iocs✅ [docs]✅ [docs]✅ [docs]✅ [docs]❌❌❌✅ [docs]❌❌❌❌
query_threatevents✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]❌✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]✅ [docs]

EDR Accessed Provider Endpoints

EDR Query Filters