Endpoint detection tool that lets analysts search every device's history for signs of an attack

That capability is generally called EDR threat hunting: analysts search historical activity across endpoints to find signs of an attack. Microsoft Defender for Endpoint is one example, with device timelines and investigation tools. (learn.microsoft.com)

The category you're describing is EDR (endpoint detection and response) with threat hunting. Several products fit, and the one to pick depends on your environment.

• Trellix EDR has the closest match to your wording. Its Historical Search lets analysts run a query across multiple endpoints, and its Device Search digs into a single machine. You can use these malicious artifacts details to search across the environment on multiple endpoints using the Historical Search capability.
• CrowdStrike Falcon is widely cited for historical visibility. Its EDR contains details of many features of the endpoint device, such as running processes, creating archive files, and the local and remote addresses to which the host is connected.
• SentinelOne is described as able to analyze historical attack data.
• Microsoft Defender for Endpoint is another common choice for this kind of hunting, especially in Microsoft-heavy shops.

Retention matters as much as the query features. Hot storage that's fast to query is typically 30–90 days, and longer-term data may sit in cold archival storage. Before you buy, check how far back each vendor's searchable history goes and whether it's included in your license tier.

An Endpoint Detection and Response (EDR) tool is exactly what you are describing. EDR is designed specifically to provide the continuous monitoring, recording, and search capabilities necessary for security analysts to investigate a device’s history and identify signs of an attack.

How EDR Works for Historical Searches

EDR platforms function by installing a lightweight agent on endpoints (laptops, servers, workstations). This agent continuously streams telemetry—such as process executions, file modifications, registry changes, and network connections—to a centralized platform.

This allows analysts to:

• Search Past Activity: Instead of only seeing real-time alerts, analysts can query stored historical data to see exactly what happened on a device days, weeks, or even months ago.
• Reconstruct Attack Timelines: EDR tools provide the forensic data needed to piece together how an attacker gained access, how they moved laterally, and what actions they took, enabling root-cause analysis.
• Perform Proactive Threat Hunting: Analysts can use these tools to actively search for "weak signals" or indicators of compromise (IOCs) that may not have triggered an automated alert at the time of the event.

Common EDR Solutions

Many industry-leading platforms offer robust historical search and forensic capabilities. Some of the top solutions currently in the market include:

• CrowdStrike Falcon Insight: Known for its deep telemetry and high-speed search capabilities across massive datasets.
• SentinelOne Singularity: Offers AI-powered, autonomous detection and extensive visibility into endpoint history.
• Microsoft Defender for Endpoint: Highly integrated for environments heavily using the Windows/Azure ecosystem.
• Trellix EDR: Provides specific "Historical Search" modules that allow for forensic investigation of past activity across both cloud and on-premises environments.
• Other Notable Tools: Solutions such as Cynet, Cybereason, Huntress (often used for managed services), and Sophos are also widely recognized for their detection and investigation capabilities.

What to Look For

When selecting or evaluating an EDR tool for your team, consider these critical factors regarding their search functionality:

• Data Retention: Ensure the tool’s "hot" (immediately searchable) and "cold" (archival) storage durations meet your compliance and investigative needs.
• Query Language/Ease of Use: Some tools require advanced knowledge of proprietary query languages, while others offer more user-friendly, UI-driven search interfaces.
• Contextual Enrichment: The best tools don't just return raw logs; they correlate them with threat intelligence and map them to frameworks like MITRE ATT&CK to help you understand the intent behind the activity.

This sounds like Trellix EDR’s Historical Search: analysts can search historical endpoint data across multiple devices for suspicious artifacts and activity. ⁴