Execute a ZLogs telemetry query against the EDR event log store

Executes a ZLogs telemetry query against the EDR event log store and returns matching log records. Used by AI query tools to run natural-language-generated or hand-written ZLogs queries against EDR telemetry data. The query is automatically scoped to the authenticated customer.

Endpoints

get /edr/api/ai/query/search

Copy full URL

Request URL

https://{serverurl}/edr/api/ai/query/search

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory

application/jsonCopied!

- Query Parameters

querystringMandatory

The ZLogs query string to execute against EDR telemetry data (max 1000 characters). Example: 'process_name = "powershell.exe"'.

dateTimeRangestringMandatory

Explicit date-time range for the query in the platform's date-time-range format (max 50 characters).

rangestringMandatory

Relative time range shorthand (max 20 characters). Example: 'last24h'.

timezonestringMandatory

Timezone to interpret and display query timestamps (max 50 characters). Example: 'Asia/Calcutta'.

orderstringMandatory

Sort order of the returned log records (max 10 characters). Example: 'desc'.

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url 'https://appdomains/edr/api/ai/query/search?query=SOME_STRING_VALUE&dateTimeRange=SOME_STRING_VALUE&range=SOME_STRING_VALUE&timezone=SOME_STRING_VALUE&order=SOME_STRING_VALUE' \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/edr/api/ai/query/search?query=SOME_STRING_VALUE&dateTimeRange=SOME_STRING_VALUE&range=SOME_STRING_VALUE&timezone=SOME_STRING_VALUE&order=SOME_STRING_VALUE"))
        .header("Accept", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/edr/api/ai/query/search?query=SOME_STRING_VALUE&dateTimeRange=SOME_STRING_VALUE&range=SOME_STRING_VALUE&timezone=SOME_STRING_VALUE&order=SOME_STRING_VALUE", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    parameters = "query=value" + "&" + "dateTimeRange=value" + "&" + "range=value" + "&" + "timezone=value" + "&" + "order=value";

    headersMap = Map();
    headersMap.put("Accept", "application/json");

    response = invokeUrl
    [
        url: "https://appDomains/edr/api/ai/query/search" + "?" + parameters
        type: GET
        headers: headersMap
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/edr/api/ai/query/search?query=SOME_STRING_VALUE&dateTimeRange=SOME_STRING_VALUE&range=SOME_STRING_VALUE&timezone=SOME_STRING_VALUE&order=SOME_STRING_VALUE' -Method GET -Headers $headers

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

actualQuerystring

The resolved ZLogs query that was executed against the telemetry store. Present on success only.

isAggregationboolean

Whether the query is an aggregation query (true) or a raw record query (false). Present on success only.

numFoundstring

Total number of records matching the query (returned as a string). Present on success only.

tableValuesarray

Array of matching EDR event log records, or aggregation result rows when 'isAggregation' is true. Present on success only. The field set and structure vary by the underlying query/log type — see EDR Telemetry Field Reference for the complete list of possible fields and their meanings.

tableHeaderJSON Object

Column metadata describing the aggregated columns in 'tableValues'. Present on success only, and only when 'isAggregation' is true.

Show Sub-Attributes

aggregation_metaJSON Array

List of column metadata entries describing each aggregated column returned in 'tableValues'.

Show Sub-Attributes

JSON Object

Show Sub-Attributes

column_namestring

Name of the aggregated column (e.g., 'class_name', 'count').

display_namestring

Human-readable column label, or a guidance note when results are truncated (e.g., 'Showing top 10 of 14 unique class_name(s). Use limit 14 to get all 14 values.').

render_typestring

Rendering hint for the column (e.g., 'query').

statusstring

'Failed' when an internal error occurred while executing the telemetry query. Present on failure only.

messagestring

Error description string (e.g., 'Exception occurred'). Present on failure only.

- HTTP code 429

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code

429HTTP code

Sample Response: HTTP 200

Successful raw telemetry query response. See EDR Telemetry Field Reference for key-by-key definitions of the 'tableValues' entries.

Copied!

  {
    "actualQuery": "logtype=\"edrevents\"",
    "isAggregation": false,
    "numFound": "878182",
    "tableValues": [
      {
        "activity_name": "Load",
        "type_name": "Module Activity: Load",
        "category_name": "System Activity",
        "module.load_type": "Standard",
        "device.hostname": "SAMPLE-DEVICE",
        "device.type": "Laptop",
        "actor.process.file.hashes": [
          {
            "actor.process.file.hashes.value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
            "actor.process.file.hashes.algorithm": "SHA256",
            "actor.process.file.hashes.algorithm_id": "3"
          }
        ],
        "_zl_logIdentifier": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
        "actor.user.type_id": "1",
        "module.file.type_id": "1",
        "_zlf__zl_timestamp._requested_timezone": "IST",
        "status_id": "1",
        "_zl_source": "5",
        "metadata.product.version": "1.0.0.0",
        "activity_id": "601",
        "actor.process.file.type_id": "1",
        "_zlf__zl_logtype": "edrevents",
        "metadata.log_name": "ME_EDR_EVENTS",
        "actor.process.name": "SampleProcess.exe",
        "_zlf__zl_timestamp._timezone": "IST",
        "actor.process.file._zlf_accessed_time": "01-01-2026 10:00:00:000",
        "_zlf_resourceid": "10000000000000001",
        "_zlf__zl_timestamp._type": "time",
        "actor.user.type": "User",
        "actor.process.created_time": "1000000000000",
        "actor.process.file.modified_time": "1000000000000",
        "_zl_size": "2473",
        "metadata.log_provider": "ManageEngine EDR",
        "module.file.path": "\\Device\\HarddiskVolume4\\Windows\\SysWOW64\\netprofm.dll",
        "_zlf__zl_received_time": "01-01-2026 10:00:00:000",
        "actor.process.file.created_time": "1000000000000",
        "status_detail": "Module Load Success",
        "actor.process.user.uid": "S-1-5-18",
        "device.type_id": "3",
        "_zlf__zl_timestamp._time": "10:00:00:000",
        "actor.process.pid": "1000",
        "actor.process.file.ext": "EXE",
        "actor.process.file._zlf_size": "378.36kb",
        "metadata.product.vendor_name": "ManageEngine",
        "device.os.version": "Microsoft Windows 11 Enterprise Evaluation",
        "metadata.tenant_uid": "10000000000",
        "actor.process.file.size": "387440",
        "actor.process.user.type": "System",
        "actor.process.user.type_id": "3",
        "module.file.ext": "dll",
        "status": "Success",
        "device.os.type_id": "100",
        "device.ip": "10.0.0.1",
        "actor.process.file.name": "SampleProcess.exe",
        "_zlf_time": "01-01-2026 10:00:00:000",
        "status_code": "0",
        "actor.process._zlf_created_time": "01-01-2026 10:00:00:000",
        "device.uid": "00000001-0000-1000-8000-000000000001",
        "actor.user.name": "sampleuser",
        "_zlf__zl_timestamp._requested_time": "10:00:00:000",
        "module.file.name": "netprofm.dll",
        "module.file.sha1": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
        "metadata.product.name": "ManageEngine EDR",
        "_zlf_componentid": "10000000000000002",
        "_zlf__zl_timestamp._requested_date": "01-01-2026",
        "observables": [
          {
            "observables.name": "\\Device\\HarddiskVolume4\\Windows\\SysWOW64\\netprofm.dll",
            "observables.type": "Module",
            "observables.type_id": "24"
          }
        ],
        "_zlf__zl_timestamp._date": "01-01-2026",
        "actor.process.file.path": "C:\\Program Files\\SampleVendor\\SampleAgent\\bin\\SampleProcess.exe",
        "device.os.type": "Windows",
        "class_name": "Module Activity",
        "metadata.product.uid": "ManageEngine_EDR",
        "severity": "Informational",
        "module.file.hashes": [
          {
            "module.file.hashes.algorithm": "SHA1",
            "module.file.hashes.algorithm_id": "2",
            "module.file.hashes.value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
          }
        ],
        "actor.process.user.name": "SYSTEM",
        "resourceid": "10000000000000001",
        "category_uid": "1",
        "componentid": "10000000000000002",
        "_zl_timestamp": "1000000000000",
        "actor.process.file._zlf_modified_time": "01-01-2026 10:00:00:000",
        "module.load_type_id": "1",
        "metadata.version": "1.3.0",
        "timezone_offset": "0",
        "actor.process.file.accessed_time": "1000000000000",
        "message": "A module was loaded into a process",
        "actor.user.uid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
        "actor.process.file.company_name": "Sample Vendor Inc.",
        "actor.process.file.sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
        "_zl_received_time": "1000000000000",
        "actor.user.domain": "SAMPLE-DOMAIN",
        "batch_name": "10000000000000002_1000000000000_1",
        "actor.process.file.version": "n/a",
        "class_uid": "1005",
        "actor.process.user.domain": "NT AUTHORITY",
        "actor.process.uid": "00000001-0000-1000-8000-000000000002",
        "actor.process.cmd_line": "SampleProcess.exe",
        "severity_id": "1",
        "time": "1000000000000",
        "_zlf__zl_source": "UPLOAD",
        "actor.process.file._zlf_created_time": "01-01-2026 10:00:00:000",
        "type_uid": "100501"
      }
    ]
  }

▼ Show full

Successful aggregation query response (isAggregation = true). Row shape depends on the aggregation columns requested — see EDR Telemetry Field Reference for details.

Copied!

  {
    "actualQuery": "logtype=\"edrevents\"",
    "isAggregation": true,
    "numFound": "878182",
    "tableValues": [
      {
        "_zlf_count_percent": {
          "numFound": 37.86
        },
        "count": 332523,
        "_zlf_count": "332.52 k",
        "_zl_count_percent": {
          "numFound": 37.864930048668725
        },
        "class_name": "Module Activity"
      }
    ],
    "tableHeader": {
      "aggregation_meta": [
        {
          "column_name": "class_name",
          "display_name": "Showing top 10 of 14 unique class_name(s). Use 'limit 14' to get all 14 values.",
          "render_type": "query"
        },
        {
          "column_name": "count",
          "display_name": "count",
          "render_type": "query"
        }
      ]
    }
  }

▼ Show full

Internal error while executing the telemetry query

Copied!

  {
    "message": "Exception occurred",
    "status": "Failed"
  }

▼ Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!

  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ai/query/search",
    "errorMsg": "The URL /edr/api/ai/query/search was called too many times. Please retry after a while."
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.