Search entities

Searches the caller's entities of one type with an EQL filter, one page at a time. The search always pages: limit is the page size, and nextCursor, when present, fetches the next page. Entities come back in a stable order, each exactly once across the pages. Requires the Attack Surface Insights permission and a subscription that includes Entity Management. To find the entities that carry a tag, filter on it, such as tags: "vip". A property the request doesn't define is a 400.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

The entity search request. Every property is optional. Any other property is a 400.

string
Defaults to USER

USER or DEVICE, in any case

string

An EQL filter, such as tags: "vip" or user_name: "jdoe". Absent or blank matches every entity of the type. Context queries (context(...)) aren't supported.

int32
1 to 5000
Defaults to 1000

The page size

string

The nextCursor of the previous page, to fetch the page after it

Responses

Language
Credentials
OAuth2
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json