genian-edr-threats

Lists threats the way the threat management screen does, newest first.

genian-edr-threats [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE] [states=VALUE] [types=VALUE] [dsl=VALUE]

profile=VALUE: Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted.
duration=VALUE: Optional. Scan only recent data, in s(second), m(minute), h(hour), d(day) or mon(month). For example, 10s means data from 10 seconds earlier.
from=VALUE: Optional. Start of the range in yyyyMMddHHmmss. An omitted time part is padded with zero.
to=VALUE: Optional. End of the range in yyyyMMddHHmmss. An omitted time part is padded with zero.
states=VALUE: Optional. Comma separated states to keep: new, inprogress, resolved. All when omitted.
types=VALUE: Optional. Comma separated detect types to keep, e.g. Malware, XBA. All when omitted.
dsl=VALUE: Optional. Additional Lucene condition with the Elasticsearch field names, the genian-edr-search syntax, e.g. HostName:"PC-01".

Output Fields

Field	Type	Name	Description
threat_id	String	Threat ID	e.g. 5f1c9e3a7d2b48c6a0e4f81b3d9c2a76. ID of the threat, what the threat-id option takes.
detect_time	Date	Detect time	e.g. 2026-11-07 00:14:20. When the threat was detected.
detect_type	String	Detect type	e.g. XBA. Malware, XBA (abnormal behavior) and so on.
detect_sub_type	String	Detect sub type	e.g. Exploit. Sub type of the detection, e.g. Exploit, MaliciousIP.
state	String	State	e.g. new. new, inprogress or resolved.
alert_decision	String	Verdict	e.g. true. true (malicious), false (safe), unknown (on hold); absent when not decided.
level	Integer	Level	e.g. 9. 3 critical, 2, 1, 9 information; 100 more for a resolved threat.
score	Integer	Score	e.g. 80. Confidence of the detection (%).
host_name	String	Host name	e.g. DESKTOP-A1B2C3D. Host the threat was detected on.
device_id	String	Device ID	e.g. 0f8c2a4e-1b7d-4e5a-9c3f-2d6b8e1a7c45. Agent device ID.
ip	IP	IP	e.g. 10.10.20.31. IP address of the device.
auth_name	String	User name	e.g. 홍길동. Authenticated user of the device.
file_name	String	File name	e.g. powershell.exe. File the detection is about.
file_path	String	File path	e.g. C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. Path of the file.
md5	String	MD5	e.g. 7b2e9c41d0a5f83e6c1b4d92a8f0e357. MD5 of the file.
sha256	String	SHA256	e.g. 3f8a1c6e9b2d4f70a5c8e1b3d6f9a2c4e7b0d3f6a9c2e5b8d1f4a7c0e3b6d9f2. SHA256 of the file.
proc_name	String	Process name	e.g. C:\Program Files\Vendor\Agent\agent.exe. Process that raised the detection.
proc_guid	String	Process GUID	e.g. 9C3E1A7F5B2D48E6A0F4C8B1D7E3925A6F0B12. GUID of the process; the ProcGuid of genian-edr-search.
cmd_line	String	Command line	e.g. "C:\Program Files\Vendor\Agent\agent.exe". Command line of the process.
rule_id	String	Rule ID	e.g. SuspiciousPowershellCommand. ID of the detection rule.
rule_name	String	Rule name	e.g. 의심스러운 파워쉘 실행. Name of the detection rule.
remote_ip	IP	Remote IP	e.g. 203.0.113.24. Remote address of a network detection.
remote_port	Integer	Remote port	e.g. 443. Remote port of a network detection; 0 otherwise.
dns_name	String	DNS name	e.g. update.example.com. Domain of the remote address.
verdict	String	Classification	Malware classification of the console
assignee	String	Assignee	e.g. admin01. Console account handling the threat.
memo	String	Memo	Memo left on the threat
tactic	List	Tactics	e.g. [Execution]. MITRE ATT&CK tactics.
title	String	Title	e.g. powershell.exe. What the threat list names the threat by: the file, process or remote address.
_time	Date	Time	e.g. 2026-11-07 00:14:20. Representative time of the row.