# Execute a ZLogs telemetry query against the EDR event log store Executes a ZLogs telemetry query against the EDR event log store and returns matching log records. Used by AI query tools to run natural-language-generated or hand-written ZLogs queries against EDR telemetry data. The query is automatically scoped to the authenticated customer. ## Endpoints **GET** `/edr/api/ai/query/search` ## Request URL `https://`[*{serverurl}*](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)`/edr/api/ai/query/search` ## Scope `DesktopCentralCloud.EDR.READ` ## Header `Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52` ## Request Parameters ### Request Headers - **Accept** `string` — **Mandatory** - `application/json` ### Query Parameters - **query** `string` — **Mandatory** - The ZLogs query string to execute against EDR telemetry data (max 1000 characters). Example: `'process_name = "powershell.exe"'`. - **dateTimeRange** `string` — **Mandatory** - Explicit date-time range for the query in the platform's date-time-range format (max 50 characters). - **range** `string` — **Mandatory** - Relative time range shorthand (max 20 characters). Example: `'last24h'`. - **timezone** `string` — **Mandatory** - Timezone to interpret and display query timestamps (max 50 characters). Example: `'Asia/Calcutta'`. - **order** `string` — **Mandatory** - Sort order of the returned log records (max 10 characters). Example: `'desc'`. ## Sample Request ```curl curl --request GET \ --url 'https://appdomains/edr/api/ai/query/search?query=SOME_STRING_VALUE&dateTimeRange=SOME_STRING_VALUE&range=SOME_STRING_VALUE&timezone=SOME_STRING_VALUE&order=SOME_STRING_VALUE' \ --header 'Accept: application/json' \ --header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' ``` ## Response Parameters ### HTTP Code 200 #### Response Body — `application/json` `JSON Object` - **actualQuery** `string` - The resolved ZLogs query that was executed against the telemetry store. Present on success only. - **isAggregation** `boolean` - Whether the query is an aggregation query (`true`) or a raw record query (`false`). Present on success only. - **numFound** `string` - Total number of records matching the query (returned as a string). Present on success only. - **tableValues** `array` - Array of matching EDR event log records, or aggregation result rows when `'isAggregation'` is true. Present on success only. The field set and structure vary by the underlying query/log type — see [EDR Telemetry Field Reference](https://www.manageengine.com/products/desktop-central/help/edr/telemetry-schema.html) for the complete list of possible fields and their meanings. - **tableHeader** `JSON Object` - Column metadata describing the aggregated columns in `'tableValues'`. Present on success only, and only when `'isAggregation'` is true. - **status** `string` - `'Failed'` when an internal error occurred while executing the telemetry query. Present on failure only. - **message** `string` - Error description string (e.g., `'Exception occurred'`). Present on failure only. ### HTTP Code 429 #### Response Body — `application/json` `JSON Object` - **errorCode** `string` - Rate limit error code. - `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window. - **errorMessage** `string` - Rate limit exceeded message with guidance on when to retry. ## Possible Response Codes - **200** — HTTP code - **429** — HTTP code ## Sample Response: HTTP 200 Successful raw telemetry query response. See [EDR Telemetry Field Reference](https://www.manageengine.com/products/desktop-central/help/edr/telemetry-schema.html) for key-by-key definitions of the `'tableValues'` entries. ```json { "actualQuery": "logtype=\"edrevents\"", "isAggregation": false, "numFound": "878182", "tableValues": [ { "activity_name": "Load", "type_name": "Module Activity: Load", "category_name": "System Activity", "module.load_type": "Standard", "device.hostname": "SAMPLE-DEVICE", "device.type": "Laptop", "actor.process.file.hashes": [ { "actor.process.file.hashes.value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "actor.process.file.hashes.algorithm": "SHA256", "actor.process.file.hashes.algorithm_id": "3" } ], "_zl_logIdentifier": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "actor.user.type_id": "1", "module.file.type_id": "1", "_zlf__zl_timestamp._requested_timezone": "IST", "status_id": "1", "_zl_source": "5", "metadata.product.version": "1.0.0.0", "activity_id": "601", "actor.process.file.type_id": "1", "_zlf__zl_logtype": "edrevents", "metadata.log_name": "ME_EDR_EVENTS", "actor.process.name": "SampleProcess.exe", "_zlf__zl_timestamp._timezone": "IST", "actor.process.file._zlf_accessed_time": "01-01-2026 10:00:00:000", "_zlf_resourceid": "10000000000000001", "_zlf__zl_timestamp._type": "time", "actor.user.type": "User", "actor.process.created_time": "1000000000000", "actor.process.file.modified_time": "1000000000000", "_zl_size": "2473", "metadata.log_provider": "ManageEngine EDR", "module.file.path": "\\Device\\HarddiskVolume4\\Windows\\SysWOW64\\netprofm.dll", "_zlf__zl_received_time": "01-01-2026 10:00:00:000", "actor.process.file.created_time": "1000000000000", "status_detail": "Module Load Success", "actor.process.user.uid": "S-1-5-18", "device.type_id": "3", "_zlf__zl_timestamp._time": "10:00:00:000", "actor.process.pid": "1000", "actor.process.file.ext": "EXE", "actor.process.file._zlf_size": "378.36kb", "metadata.product.vendor_name": "ManageEngine", "device.os.version": "Microsoft Windows 11 Enterprise Evaluation", "metadata.tenant_uid": "10000000000", "actor.process.file.size": "387440", "actor.process.user.type": "System", "actor.process.user.type_id": "3", "module.file.ext": "dll", "status": "Success", "device.os.type_id": "100", "device.ip": "10.0.0.1", "actor.process.file.name": "SampleProcess.exe", "_zlf_time": "01-01-2026 10:00:00:000", "status_code": "0", "actor.process._zlf_created_time": "01-01-2026 10:00:00:000", "device.uid": "00000001-0000-1000-8000-000000000001", "actor.user.name": "sampleuser", "_zlf__zl_timestamp._requested_time": "10:00:00:000", "module.file.name": "netprofm.dll", "module.file.sha1": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "metadata.product.name": "ManageEngine EDR", "_zlf_componentid": "10000000000000002", "_zlf__zl_timestamp._requested_date": "01-01-2026", "observables": [ { "observables.name": "\\Device\\HarddiskVolume4\\Windows\\SysWOW64\\netprofm.dll", "observables.type": "Module", "observables.type_id": "24" } ], "_zlf__zl_timestamp._date": "01-01-2026", "actor.process.file.path": "C:\\Program Files\\SampleVendor\\SampleAgent\\bin\\SampleProcess.exe", "device.os.type": "Windows", "class_name": "Module Activity", "metadata.product.uid": "ManageEngine_EDR", "severity": "Informational", "module.file.hashes": [ { "module.file.hashes.algorithm": "SHA1", "module.file.hashes.algorithm_id": "2", "module.file.hashes.value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } ], "actor.process.user.name": "SYSTEM", "resourceid": "10000000000000001", "category_uid": "1", "componentid": "10000000000000002", "_zl_timestamp": "1000000000000", "actor.process.file._zlf_modified_time": "01-01-2026 10:00:00:000", "module.load_type_id": "1", "metadata.version": "1.3.0", "timezone_offset": "0", "actor.process.file.accessed_time": "1000000000000", "message": "A module was loaded into a process", "actor.user.uid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "actor.process.file.company_name": "Sample Vendor Inc.", "actor.process.file.sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "_zl_received_time": "1000000000000", "actor.user.domain": "SAMPLE-DOMAIN", "batch_name": "10000000000000002_1000000000000_1", "actor.process.file.version": "n/a", "class_uid": "1005", "actor.process.user.domain": "NT AUTHORITY", "actor.process.uid": "00000001-0000-1000-8000-000000000002", "actor.process.cmd_line": "SampleProcess.exe", "severity_id": "1", "time": "1000000000000", "_zlf__zl_source": "UPLOAD", "actor.process.file._zlf_created_time": "01-01-2026 10:00:00:000", "type_uid": "100501" } ] } ``` Successful aggregation query response (`isAggregation = true`). Row shape depends on the aggregation columns requested — see [EDR Telemetry Field Reference](https://www.manageengine.com/products/desktop-central/help/edr/telemetry-schema.html) for details. ```json { "actualQuery": "logtype=\"edrevents\"", "isAggregation": true, "numFound": "878182", "tableValues": [ { "_zlf_count_percent": { "numFound": 37.86 }, "count": 332523, "_zlf_count": "332.52 k", "_zl_count_percent": { "numFound": 37.864930048668725 }, "class_name": "Module Activity" } ], "tableHeader": { "aggregation_meta": [ { "column_name": "class_name", "display_name": "Showing top 10 of 14 unique class_name(s). Use 'limit 14' to get all 14 values.", "render_type": "query" }, { "column_name": "count", "display_name": "count", "render_type": "query" } ] } } ``` Internal error while executing the telemetry query. ```json { "message": "Exception occurred", "status": "Failed" } ``` ## Sample Response: HTTP 429 API call threshold exceeded. ```json { "errorCode": "IAM0019", "url": "/edr/api/ai/query/search", "errorMsg": "The URL /edr/api/ai/query/search was called too many times. Please retry after a while." } ``` ## Rate Limit **Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes Duration - Time window for the threshold. Threshold - Number of API calls allowed within the specified duration. Lock Period - Wait time before consecutive API requests.