Configuration - EDR integrations
Configure endpoint detection and response (EDR) providers and review bulk scans.
List bulk scans
Returns bulk scan summaries, newest first by `start_time`.
Get the running bulk scan
Reports whether a bulk scan job is running now.
Get a bulk scan
Returns one bulk scan summary with detail fields. `{id}` is the `bulk_scan_id` value, not a database id.
List EDR configurations
Returns every active EDR configuration as a plain JSON array (not paged, no pagination headers).
Create an EDR configuration
Creates a configuration for one provider. The `provider` property selects the schema.
Test an EDR connection
Tests the integration settings against the provider ('Test Connection').
Get an EDR configuration
Returns one configuration by id, including a soft-deleted one. Secrets are never returned.
Update an EDR configuration
Merges the supplied `config.integration` and `config.investigation` values into the stored configuration.
Delete an EDR configuration
Soft-deletes the configuration: `active` becomes false and the name is renamed to `<name>_deleted_<unix-ms>` so the name can be reused.