genian-edr-threat-devices
Lists the devices the threat was detected on.
genian-edr-threat-devices [profile=VALUE] threat-id=VALUE [size=VALUE]
- profile=VALUE
- Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted.
- threat-id=VALUE
- Required. Threat to read, the threat_id of genian-edr-threats
- size=VALUE
- Optional. Maximum number of devices. Defaults to 100.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| device_id | String | Device ID | e.g. 0f8c2a4e-1b7d-4e5a-9c3f-2d6b8e1a7c45. Agent device ID. |
| host_name | String | Host name | e.g. DESKTOP-A1B2C3D. Host name of the device. |
| ip | IP | IP | e.g. 10.10.20.31. IP address of the device. |
| count | Integer | Count | e.g. 3. Alerts on the device. |
| desc | String | Description | e.g. <b>powershell.exe</b> 에 의한 <b>의심스러운 파워쉘 실행</b> 이상행위가 진단됨 (<b>80%</b>). Indicator sentence of the latest alert. |
| detect_time | Date | Detect time | e.g. 2026-11-07 00:14:20. Latest alert on the device. |
| status | String | Agent status | e.g. AGENT_RUNNING. Agent status. |
| is_active | Boolean | Active | e.g. true. Whether the agent is up. |
| response_rule | String | Response rule | Individual response rule of the device |
| _time | Date | Time | e.g. 2026-11-07 00:14:20. Representative time of the row. |