# EDR Query Orders

This document provides details on the query order fields and directions that are supported by each provider for each operation. Orders can be used to specify the direction of the results of an operation, such as ordering by a specific field in ascending or descending order. If a provider or operation does not support ordering, it will not be listed here.

## Query Alerts

| Field | Bitdefender GravityZone EDR | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Endpoint | ESET Connect | Iru | ThreatDown Endpoint Detection & Response | SentinelOne Singularity™ Endpoint | Sophos Endpoint | Tanium EDR | Trellix ePolicy Orchestrator | Trellix Endpoint Security (ENS) |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| attacks.tactic.name |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| attacks.tactic.uid |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| attacks.technique.name |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| attacks.technique.uid |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| comment |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| composite_id |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| confidence_score |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.first_seen_time |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.first_seen_time_dt |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.hostname |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.last_seen_time |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.last_seen_time_dt |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.os.type |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.uid |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| device.uid_alt |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| finding_info.created_time |  | asc, desc |  |  |  |  |  |  |  |  | asc, desc |  |
| finding_info.created_time_dt |  | asc, desc |  |  |  |  |  |  |  |  | asc, desc |  |
| finding_info.first_seen_time |  |  |  |  |  |  |  |  |  |  | asc, desc |  |
| finding_info.first_seen_time_dt |  |  |  |  |  |  |  |  |  |  | asc, desc |  |
| finding_info.last_seen_time |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| finding_info.last_seen_time_dt |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| finding_info.types |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| finding_info.uid |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| metadata.loggers.logged_time |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| metadata.product.feature.name |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| metadata.tenant_uid |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| resources.name |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| resources.uid |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| risk_score |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| severity |  |  |  |  |  | asc, desc |  |  |  |  |  |  |
| start_time |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| start_time_dt |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| time |  | asc, desc |  |  |  | asc, desc |  |  |  |  | asc, desc |  |
| time_dt |  | asc, desc |  |  |  |  |  |  |  |  | asc, desc |  |
| vulnerabilities.desc |  | asc, desc |  |  |  |  |  |  |  |  |  |  |
| vulnerabilities.title |  | asc, desc |  |  |  |  |  |  |  |  |  |  |


## Query Applications

| Field | Bitdefender GravityZone EDR | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Endpoint | ESET Connect | Iru | ThreatDown Endpoint Detection & Response | SentinelOne Singularity™ Endpoint | Sophos Endpoint | Tanium EDR | Trellix ePolicy Orchestrator | Trellix Endpoint Security (ENS) |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| product.name |  | asc, desc |  | asc, desc |  |  | asc, desc | asc, desc | asc, desc | asc, desc |  |  |


## Query EDR Events

| Field | Bitdefender GravityZone EDR | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Endpoint | ESET Connect | Iru | ThreatDown Endpoint Detection & Response | SentinelOne Singularity™ Endpoint | Sophos Endpoint | Tanium EDR | Trellix ePolicy Orchestrator | Trellix Endpoint Security (ENS) |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| time |  |  |  | asc, desc |  |  |  |  |  | asc, desc |  | asc, desc |


## Query Endpoints

| Field | Bitdefender GravityZone EDR | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Endpoint | ESET Connect | Iru | ThreatDown Endpoint Detection & Response | SentinelOne Singularity™ Endpoint | Sophos Endpoint | Tanium EDR | Trellix ePolicy Orchestrator | Trellix Endpoint Security (ENS) |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| device.hostname |  |  |  | asc, desc |  |  |  |  |  |  | asc, desc | asc, desc |
| device.hw_info.serial_number |  |  |  |  |  |  |  |  |  |  | asc, desc | asc, desc |
| device.ip |  |  |  |  |  |  |  |  |  |  | asc, desc | asc, desc |
| device.last_seen_time |  |  |  | asc, desc |  |  |  |  |  |  | asc, desc | asc, desc |
| device.name |  |  |  |  |  |  |  |  |  |  | asc, desc | asc, desc |
| status |  |  |  |  |  |  | asc, desc |  | asc, desc |  |  |  |
| time |  | asc, desc |  | asc, desc |  |  |  | asc, desc |  |  | asc, desc | asc, desc |


## Query IOAs

| Field | Bitdefender GravityZone EDR | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Endpoint | ESET Connect | Iru | ThreatDown Endpoint Detection & Response | SentinelOne Singularity™ Endpoint | Sophos Endpoint | Tanium EDR | Trellix ePolicy Orchestrator | Trellix Endpoint Security (ENS) |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| created_time |  |  |  | asc, desc |  |  |  | asc, desc |  |  |  |  |
| modified_time |  |  |  | asc, desc |  |  |  | asc, desc |  |  |  |  |
| name |  |  |  | asc, desc |  |  |  |  |  |  |  |  |


## Query Threat Events

| Field | Bitdefender GravityZone EDR | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Endpoint | ESET Connect | Iru | ThreatDown Endpoint Detection & Response | SentinelOne Singularity™ Endpoint | Sophos Endpoint | Tanium EDR | Trellix ePolicy Orchestrator | Trellix Endpoint Security (ENS) |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| finding_info.created_time_dt |  |  |  |  | asc, desc |  |  |  |  |  |  |  |
| finding_info.first_seen_time_dt |  |  |  |  |  |  |  |  |  |  | asc, desc |  |
| finding_info.modified_time_dt |  |  |  |  | asc, desc |  |  |  |  |  | asc, desc |  |
| finding_info.title |  |  |  |  | asc, desc |  |  |  |  |  |  |  |
| severity |  |  |  |  | asc, desc |  |  |  |  |  | asc, desc |  |
| time |  |  |  |  |  |  |  |  |  |  | asc, desc | asc, desc |