The Real-time Search API response objects or artifacts

You can create the Real-time Search queries using the Trellix EDR collectors and the respective response objects or artifacts.

Artifact (collector)	Attributes
Processes	name id threadcount parentid parentname parentimagepath file_reputation process_reputation started_at content_size content content_file execution_mode size md5 sha1 cmdline imagepath kerneltime usertime uptime user user_id sha256 normalized_cmdline parent_cmdline
ProcessHistory	name id threadcount parentid parentname parentimagepath file_reputation started_at finished_at status content_size content content_file execution_mode exitstatus size md5 sha1 cmdline imagepath kerneltime usertime uptime user user_id sha256 normalized_cmdline parent_cmdline
Files	name dir full_name size last_write md5 sha1 sha256 created_at deleted_at status create_process_pid create_process_sha256 create_process_full_path modify_process_pid modify_process_sha256 modify_process_full_path delete_process_pid delete_process_sha256 delete_process_full_path create_user_domain create_user_name create_user_id modify_user_domain modify_user_name modify_user_id delete_user_domain delete_user_name delete_user_id
NetworkFlow	time direction src_ip src_port dst_ip dst_port status proto ip_class seq_number src_mac dst_mac process process_id md5 sha1 user user_id sha256
CurrentFlow	disk model disk_size logical_sector physical_sector virtual_loc disk_flags partition volume partition_size partition_freespace filesystem type partition_flags
WinRegistry	keypath keyvalue valuedata valuetype
Software	displayname installdate publisher version
LoggedInUsers	id userdomain username
NetworkInterfaces	bssid displayname gwipaddress gwmacaddress ipaddress ipprefix macaddress name ssid type wifisecurity
HostEntries	ipaddress hostname
HostInfo	hostname ip_address os connection_status platform
InstalledUpdates	description hotfix_id install_date installed_by source version
LocalGroups	groupname groupdomain groupdescription islocal sid
UserProfiles	accountdisabled domain fullname installdate localaccount lockedout accountname sid passwordexpires groups
Services	description name startuptype status user
Startup	caption command description name user
InteractiveSessions	userid name
InstalledDrivers	displayname description last_modified_date name servicetype startmode state path
DNSCache	hostname ipaddress
UsbConnectedStorageDevices	vendor_id product_id serial_number device_type guid last_connection_time user_name last_time_used_by_user
NetworkShares	name description path
NetworkSessions	computer user client file idletime
EnvironmentVariables	username process_id name value
CommandLineHistory	user id command_line
InstalledCertificates	issued_to issued_by expiration_date purposes purposes_extended friendly_name
ScheduledTasks	folder taskname next_run_time last_run status taskrun username schedule_on logon_type recurrence task_source
DisksAndPartitions	disk model disk_size logical_sector physical_sector virtual_loc disk_flags partition volume partition_size partition_freespace filesystem type partition_flags
LoadedModules	process_id process_name process_imagepath module_name module_imagepath module_reputation module_md5 module_sha1 module_sha256
AutoRun	entry_location entry enabled category profile description publisher image_path version launch_string
BrowserDownload	file_path start_time end_time received_bytes total_bytes state referrer site_url mime_type browser user_profile browser_profile
BrowserHistory	url title last_visit_time visit_count visit_from browser user_profile browser_profile url_length hidden typed_count
NSACryptEvents	id process_id thread_id time_created message
TwinFiles	name dir full_name size last_write md5 sha1 sha256 created_at deleted_at status create_process_pid create_process_sha256 create_process_full_path modify_process_pid modify_process_sha256 modify_process_full_path delete_process_pid delete_process_sha256 delete_process_full_path create_user_domain create_user_name create_user_id modify_user_domain modify_user_name modify_user_id delete_user_domain delete_user_name delete_user_id