Search for events/objects in an XDR section. Returns matching records; an empty query returns the section unfiltered. Use xdr_get_mapping first to discover available fields.

Get the total count of records in an XDR section. Optionally filter by query to count matching records only. For application_versions this counts per-asset records, not distinct version strings.

Get all available search fields for an XDR section. Returns field names, labels, categories, and supported operators. Call this first to understand what you can search on.

Look up real values of a field, optionally narrowed by a prefix. Use it when a query returns nothing and the value may simply be spelled differently — an unmatched value is answered with zero records rather than an error, so a guess is indistinguishable from a genuine absence. Each entry has a value to put in a query and a label for display; search on the value. Returns up to about ten entries, so narrow the prefix to see more. Field names come from xdr_get_mapping, where the ones worth asking about carry show_suggestions; an unknown field name comes back empty rather than as an error.

Get available filter options for an XDR section.

List artifacts collected from hosts — what an analyst gathered through the asset's Response → Artifacts: bug reports, logs, configs, memory dumps. Filter by host with asset_id (the asset's numeric id) or machine_id; with neither, lists artifacts across all hosts. Newest first by default. Each row has 'id' (for xdr_get_artifact_structure), 'internal_id' (for xdr_download_artifact), 'parts' (what was collected), 'command_status' (New, Queued, Pending, Uploading, Uploaded, Done, Failed, Aborted) and 'size' in bytes.

List the files and folders inside a collected artifact, one level at a time, with their sizes. Takes the artifact's numeric 'id' from xdr_list_artifacts and an optional folder inside it (e.g. /var/log). Use it to find the part worth downloading rather than fetching a whole artifact.