Live Endpoint Search GraphQL API¶
Run osquery-style queries against endpoints, replacing the legacy Live Discover REST API.
This is a GraphQL API: every request is a POST carrying a query (or mutation) document, rather than one endpoint per operation. See the guide above for the request shape and authentication.
Queries¶
- liveDiscoverCategories
Get all Live Discover categories for the current tenant - liveDiscoverEndpointSearch
Endpoint Search to list all endpoints based on given filter criteria - liveDiscoverQueries
Get all Live Discover queries for the current tenant - liveDiscoverQuery
Get a specific Live Discover query by ID - liveDiscoverQueryRun
Get a specific Live Discover query run by ID - liveDiscoverQueryRunEndpoints
Get endpoints for a specific Live Discover query run - liveDiscoverQueryRunResults
Get results for a specific Live Discover query run - liveDiscoverQueryRunResultsCsv
Get results csv for a specific Live Discover query run - liveDiscoverQueryRuns
Get all Live Discover query runs for the current tenant
Mutations¶
- cancelLiveDiscoverQueryRun
Cancel a Live Discover query run - createLiveDiscoverCatalogCategory
Create a new category in the catalog - createLiveDiscoverQuery
Create a new Live Discover query - createLiveDiscoverSession
Create a new Live Discover session - deleteLiveDiscoverCatalogCategory
Delete a category from the catalog - deleteLiveDiscoverQuery
Delete a Live Discover query - endpointSessions
Assign or remove sessions to/from endpoints matching given filter criteria - runLiveDiscoverQuery
Run a Live Discover query execution - updateLiveDiscoverCatalogCategory
Update an existing category in the catalog - updateLiveDiscoverQuery
Update an existing Live Discover query
Types¶
AdHocQueryInputCategoryObjectReferenceCategoryTypeDeletionResponseDeletionResultEndpointCountByDataEndpointCountByStatusesEndpointCountInFinishedStatusEndpointCountInPendingStatusEndpointCountsEndpointExecutionSummaryEndpointFilterEndpointFilterInputEndpointGroupReferenceEndpointPerformanceEndpointSessionsActionEndpointSessionsFilterEndpointSessionsInputEndpointSessionsResponseEndpointSessionsSortExecutionPerformanceExecutionResultExecutionResultItemExecutionResultsColumnMetadataExecutionResultsMetadataExecutionStatusExecutionSummaryInt64JSONLiveDiscoverAssociatedPersonLiveDiscoverCategoriesLiveDiscoverCategoryLiveDiscoverCategoryInputLiveDiscoverCategoryResponseLiveDiscoverEndpointLiveDiscoverEndpointExecutionPageLiveDiscoverEndpointParamsLiveDiscoverEndpointTypeLiveDiscoverEndpointsPagedLiveDiscoverExecutionPageLiveDiscoverExecutionRequestLiveDiscoverExecutionResultsPagedLiveDiscoverExecutionSummaryResponseLiveDiscoverHealthStatusLiveDiscoverLockdownStatusLiveDiscoverQueryLiveDiscoverQueryInputLiveDiscoverQueryPageLiveDiscoverQueryParamsLiveDiscoverQueryResponseLiveDiscoverQueryRunByIdParamsLiveDiscoverQueryRunParamsLiveDiscoverQueryRunResultsParamsLiveDiscoverSessionLiveDiscoverSessionResponseLiveDiscoverUpdateQueryInputMatchEndpointsMatchEndpointsInputMinMaxOSObjectReferenceObjectReferenceInputOperatingSystemMatchOperatingSystemMatchInputOsPlatformPagesByKeyPagesByOffsetPerformanceScorePrincipalReferencePrincipalTypeQueryDataSourceQueryDataTypeQueryObjectReferenceQueryPerformanceQueryPivotTypeQueryTypeQueryVariableQueryVariableInputResultDataTypeSavedQueryInputSearchFieldSupportedPlatformAndTypeVersionMatchVersionMatchInputliveDiscoverQueryRunResultsCsvRequestParamsliveDiscoverQueryRunResultsCsvResponse