Actions86
- RemoteAccess Actions
- Reseller Actions
- List Reseller Invoices
- Get Reseller Invoice
- List Account Usage Line Items
- List Organization Usage Line Items
- List Reseller Subscriptions
- Get Reseller Subscription
- Update Reseller Subscription
- Upgrade Reseller Subscription
- List Accounts
- Create Account
- Get Specific Account
- Update Account
- Get Agent
- Update Agent
- Uninstall Agent
- Isolate Agent
- Release Agent Isolation
- List External Ports
- Get External Port
- List Account Invoices
- Get Account Invoice
- List Incident Reports
- Get Incident Report
- List Memberships
- Create a Membership
- Get Membership
- Update a User's membership
- Delete Membership
- List Organizations
- Create an Organization
- Get Organization
- Update an Organization
- Delete an Organization
- List Remediations
- Get Remediation
- Bulk Approve Remediations
- Bulk Reject Remediations
- List Summary Reports
- List Signals
- Get Signal
- List Remote Access Connections
- Get Actor
- SIEM Actions
- Accounts Actions
- Actor Actions
- Agents Actions
- Invoices Actions
- Escalations Actions
- ExternalRecon Actions
- Identities Actions
- IncidentReports Actions
- Users Actions
- Organizations Actions
- PlatformActions Actions
- SummaryReports Actions
- Signals Actions
- UnwantedAccessRules Actions
- KnownVPNs Actions
SIEM → Execute ESQL Query
AI-generatedSummary
Runs an ESQL query against Huntress SIEM logs for the specified time range. The query string must begin with FROM logs; a page token can be supplied to continue from a previous response.
Inputs
- Esql (required) — ESQL query string, required to begin with
FROM logs. - Range Start (required) — Start of the query range in ISO 8601 format.
- Range End (required) — End of the query range in ISO 8601 format.
- Page Token — Pagination token from a previous response.
- Options — Optional custom JSON request body, which is deep-merged with the fields above and takes priority for conflicting values; custom HTTP headers and query-string filters; batching, debug output, pagination settings, and request timeout.
Output shape
A single response from the Huntress SIEM query endpoint for each request.
The response fields and whether results are paginated depend on the endpoint response. The operation-scoped source pack contains signatures only, so it does not expose the runtime response handling.