URL-encoded JSON string containing a single filter object or an array of filter objects. Multiple filter objects are ANDed together.

Filter object structure:

• field (string): The data field to apply the filter on.
• op (string): The comparison operator (see below for allowed operators).
• value: The value(s) to compare against. The type depends on the field and operator (see below for allowed operators and values).

Supported operators (op) and values (value)

Exact comparison

• eq (equal to), ne (not equal to): Supported by all field types. Value can be string, number, boolean, or null.

Range & ordering

• gt (greater than), gte (greater than or equal to), lt (less than), lte (less than or equal to): Supported by number fields. Value must be a number.

List membership

• in (is in list), nin (is not in list): Supported by all field types. Value must be a JSON array of strings, numbers, booleans, or nulls.

String/text matching

• contains, startsWith, endsWith: Supported only by string fields. Value must be a string.

Presence checks

• isNull, notNull: Supported by all field types. No value field is required for these operators.

Examples

Note that examples must be url-encoded when sent.

• Single filter: {"field":"score","op":"gte","value":90}
• Multiple filters: [{"field":"device_name","op":"contains","value":"vm"},{"field":"tags","op":"in","value":["prod","qa"]}]

A URL-encoded comma-separated list of filter expressions. Filters are ANDed together implicitly.

Filter expression structure

field operator value (e.g., score gte 90)

• field: The data field to apply the filter on.
• operator: The comparison operator (supports the same operators as the _filters parameter. Read the _filters description for details).
• value: The value to compare against. When using the in and nin operators, the value can take a comma-separated list of values.

You don't need to specify field types when using this parameter. All filter expressions are sent as strings, and the server handles the conversion to the required field type.

Examples:

Note that the examples must be URL-encoded when sent.

• Simple: device_name contains server
• Multi-criteria: device_name contains server,score gte 90
• List/IN operator: tags in prod,qa

URL-encoded JSON string containing a sort object or an array of sort objects.

Sort object structure

• field (string): The data field to sort on.
• dir (string): Sort direction. Must be one of asc (ascending) or desc (descending).
• nullsLast (boolean, optional): If true, null values appear at the end of the results.

Examples

• Single field: {"field":"score","dir":"desc","nullsLast":true}
• Multi-field: [{"field":"score","dir":"desc"},{"field":"device_name","dir":"asc"}]

Comma-separated list of sort expressions. Add multiple expressions for multi-field sorting.

Sort expression structure

<field> <direction>

• field: The data field to sort by.
• direction: The sort direction, either asc, or desc.

Examples

• Simple: device_name (sorts by device_name ascending)
• Complex: device_name desc,score asc

Filter by the devive ID.

Filter by the device name.

Filter by agent connection status.

Filter by operating system name.

A search filter on the mac_address field.

A search filter on the score_severity field.

A search filter on the device_group field.

A search filter on the location field.

A search filter on the client_version field.