> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Threats

Retrieve a list of the threats detected across the managed endpoints.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [Trellix EDR documentation](https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide/page/UUID-d3c280cf-f722-d00d-2680-a54bd12cd491.html).

## Parameters

| Parameter | Description |
| - | - |
| Filter | A JSON-encoded string of the filters to apply, based on criteria such as the severity, name, or rank. **For Example:** <pre>`{  "severities": ["s0", "s1"],  "scoreRange": [30]}`</pre> |
| From | The start of the time frame to search. |
| Include | A comma-separated list of the related resources to include in the response. **For Example:** `detections,affectedhosts` |
| Limit | The maximum number of results to return. |
| Offset | The number of results to skip before starting to collect the result set. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Sort | The field to sort the threats by. Prefix with `-` for a descending order. **For Example:** `-lastDetected` |
| To | The end of the time frame to search. |

## Example Output

```json theme={"dark"}
{
	"jsonapi": {
		"version": "1.0"
	},
	"meta": {
		"totalResourceCount": 84
	},
	"data": [
		{
			"type": "threats",
			"id": "182612",
			"attributes": {
				"aggregationKey": "P_6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17",
				"severity": "s4",
				"rank": 270,
				"score": 70,
				"name": "POWERSHELL_56039776.EXE",
				"type": "pe",
				"status": "new",
				"firstDetected": "2023-08-27T05:34:29Z",
				"lastDetected": "2023-08-27T05:34:29Z",
				"edrUiUrl": "https://xconsole.trellix.com/edr/#/monitoring/#/workspace/2160,TOTAL_THREATS,8112",
				"hashes": {
					"sha256": "6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17",
					"sha1": "D9FBB3BD6269FE3D5F349A7569964DCD1AA229B5",
					"md5": "6FEE39009EA5B1110C5DA6DF2B7BDC43"
				}
			},
			"relationships": {
				"affectedhosts": {
					"data": [
						{
							"type": "affected-hosts",
							"id": "649889",
							"attributes": {
								"detectionsCount": 1,
								"severity": "s4",
								"rank": 270,
								"firstDetected": "2023-08-27T05:34:29Z",
								"host": {
									"os": {},
									"netInterfaces": [],
									"traceExtendedVisibility": 0,
									"hostOs": "",
									"aGuid": "6D0A37A8-B5B7-4414-9444-A2B17721642B"
								}
							}
						}
					],
					"links": {
						"self": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"first": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"prev": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"next": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100",
						"last": "/edr/v2/threats/182612/affectedhosts?page[offset]=0&page[limit]=100"
					}
				},
				"detections": {
					"data": [
						{
							"type": "detections",
							"id": "652404",
							"attributes": {
								"traceId": "9a718cc6-d8f6-46da-b3cc-fc4dbbd60151",
								"firstDetected": "2023-08-27T05:34:29Z",
								"severity": "s4",
								"rank": 270,
								"tags": [
									"@ATA.PrivilegeEscalation",
									"@ATA.Persistence",
									"@ATE.T1546.012",
									"@MSI._reg_ep0130_imageexecution_high",
									"@ATA.DefenseEvasion",
									"@ATE.T1112"
								],
								"host": {
									"os": {},
									"netInterfaces": [],
									"traceExtendedVisibility": 0,
									"hostOs": "",
									"aGuid": "6D0A37A8-B5B7-4414-9444-A2B17721642B"
								},
								"sha256": "6E2918727CBB836F4D8E3404BDE9AEAF5D4DED5DD1F6916AAD3F3B956E6D8A17"
							}
						}
					],
					"links": {
						"self": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"first": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"prev": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"next": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100",
						"last": "/edr/v2/threats/182612/detections?page[offset]=0&page[limit]=100"
					}
				}
			}
		}
	],
	"links": {
		"self": "/edr/v2/threats?page[offset]=0&page[limit]=1",
		"first": "/edr/v2/threats?page[offset]=0&page[limit]=1",
		"prev": "/edr/v2/threats?page[offset]=0&page[limit]=1",
		"next": "/edr/v2/threats?page[offset]=1&page[limit]=1",
		"last": "/edr/v2/threats?page[offset]=83&page[limit]=1"
	}
}
```

## Workflow Library Example

[List Threats with Trellix Edr and Send Results Via Email](https://library.blinkops.com/workflows/list-threats-with-trellix-edr-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/list-threats-with-trellix-edr-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/list-threats-with-trellix-edr-and-send-results-via-email/canvas)