cURL
curl --request POST \
--url 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts' \
--header 'BLINK-API-KEY: <api-key>' \
--header 'Content-Type: application/json' \
--data '{
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
}'
import requests
url = "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts"
payload = {
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
}
headers = {
"BLINK-API-KEY": "<api-key>",
"Content-Type": "application/json"
}
response = requests.request("POST", url, json=payload, headers=headers)
print(response.text)
const url = 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts';
const options = {
method: 'POST',
headers: {'BLINK-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
})
};
fetch(url, options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => '{"description":"Malware detected and blocked by CrowdStrike Falcon","event":"{\\"process\\": \\"malware.exe\\", \\"action\\": \\"blocked\\"}","name":"CrowdStrike Falcon Detection","processing_status":"Missing Template","severity":3,"type":"Endpoint Detection and Response (EDR)","vendor":"CrowdStrike"}',
CURLOPT_HTTPHEADER => [
"BLINK-API-KEY: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts"
payload := strings.NewReader(`{"description":"Malware detected and blocked by CrowdStrike Falcon","event":"{\"process\": \"malware.exe\", \"action\": \"blocked\"}","name":"CrowdStrike Falcon Detection","processing_status":"Missing Template","severity":3,"type":"Endpoint Detection and Response (EDR)","vendor":"CrowdStrike"}`)
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("BLINK-API-KEY", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.post("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts")
.header("BLINK-API-KEY", "<api-key>")
.header("Content-Type", "application/json")
.body("{\"description\":\"Malware detected and blocked by CrowdStrike Falcon\",\"event\":\"{\\\"process\\\": \\\"malware.exe\\\", \\\"action\\\": \\\"blocked\\\"}\",\"name\":\"CrowdStrike Falcon Detection\",\"processing_status\":\"Missing Template\",\"severity\":3,\"type\":\"Endpoint Detection and Response (EDR)\",\"vendor\":\"CrowdStrike\"}")
.asString();
require 'uri'
require 'net/http'
url = URI("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["BLINK-API-KEY"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\"description\":\"Malware detected and blocked by CrowdStrike Falcon\",\"event\":\"{\\\"process\\\": \\\"malware.exe\\\", \\\"action\\\": \\\"blocked\\\"}\",\"name\":\"CrowdStrike Falcon Detection\",\"processing_status\":\"Missing Template\",\"severity\":3,\"type\":\"Endpoint Detection and Response (EDR)\",\"vendor\":\"CrowdStrike\"}"
response = http.request(request)
puts response.read_body
{
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
}{
"data": {},
"details": "<string>",
"identifier": "<string>",
"message": "<string>",
"status": 404,
"user_error": {}
}Case Management
Create an Alert
API endpoint to create a new alert in Blink’s case management system.
POST
/
workspace
/
{ws_id}
/
case_management
/
table
/
alerts
cURL
curl --request POST \
--url 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts' \
--header 'BLINK-API-KEY: <api-key>' \
--header 'Content-Type: application/json' \
--data '{
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
}'
import requests
url = "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts"
payload = {
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
}
headers = {
"BLINK-API-KEY": "<api-key>",
"Content-Type": "application/json"
}
response = requests.request("POST", url, json=payload, headers=headers)
print(response.text)
const url = 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts';
const options = {
method: 'POST',
headers: {'BLINK-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
})
};
fetch(url, options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => '{"description":"Malware detected and blocked by CrowdStrike Falcon","event":"{\\"process\\": \\"malware.exe\\", \\"action\\": \\"blocked\\"}","name":"CrowdStrike Falcon Detection","processing_status":"Missing Template","severity":3,"type":"Endpoint Detection and Response (EDR)","vendor":"CrowdStrike"}',
CURLOPT_HTTPHEADER => [
"BLINK-API-KEY: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts"
payload := strings.NewReader(`{"description":"Malware detected and blocked by CrowdStrike Falcon","event":"{\"process\": \"malware.exe\", \"action\": \"blocked\"}","name":"CrowdStrike Falcon Detection","processing_status":"Missing Template","severity":3,"type":"Endpoint Detection and Response (EDR)","vendor":"CrowdStrike"}`)
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("BLINK-API-KEY", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.post("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts")
.header("BLINK-API-KEY", "<api-key>")
.header("Content-Type", "application/json")
.body("{\"description\":\"Malware detected and blocked by CrowdStrike Falcon\",\"event\":\"{\\\"process\\\": \\\"malware.exe\\\", \\\"action\\\": \\\"blocked\\\"}\",\"name\":\"CrowdStrike Falcon Detection\",\"processing_status\":\"Missing Template\",\"severity\":3,\"type\":\"Endpoint Detection and Response (EDR)\",\"vendor\":\"CrowdStrike\"}")
.asString();
require 'uri'
require 'net/http'
url = URI("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["BLINK-API-KEY"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\"description\":\"Malware detected and blocked by CrowdStrike Falcon\",\"event\":\"{\\\"process\\\": \\\"malware.exe\\\", \\\"action\\\": \\\"blocked\\\"}\",\"name\":\"CrowdStrike Falcon Detection\",\"processing_status\":\"Missing Template\",\"severity\":3,\"type\":\"Endpoint Detection and Response (EDR)\",\"vendor\":\"CrowdStrike\"}"
response = http.request(request)
puts response.read_body
{
"description": "Malware detected and blocked by CrowdStrike Falcon",
"event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
"name": "CrowdStrike Falcon Detection",
"processing_status": "Missing Template",
"severity": 3,
"type": "Endpoint Detection and Response (EDR)",
"vendor": "CrowdStrike"
}{
"data": {},
"details": "<string>",
"identifier": "<string>",
"message": "<string>",
"status": 404,
"user_error": {}
}Authorizations
Body
*/*
Alert Data
Available options:
Malware, Ransomware, Adware, Spyware, Crypto Miner, Data Exfiltration, Insider Threat, Network Intrusion, DoS, DDoS, MITM, SQL Injection, Email Spoofing, DNS Spoofing, C2 Communications, Rogue Device, Brute Force, Phishing, Compromised Credentials, Account Takeover, Physical, Vulnerability, Reconnaissance, Domain Takeover, Lateral Movement, Network Exposure, Data Exposure, Credential Exposure, Suspicious User Activity, Suspicious Login, Suspicious Network Activity, Suspicious USB Device, Security Policy Violation, Security Compliance Violation Example:
"Endpoint Detection and Response (EDR)"
Response
OK
Available options:
Malware, Ransomware, Adware, Spyware, Crypto Miner, Data Exfiltration, Insider Threat, Network Intrusion, DoS, DDoS, MITM, SQL Injection, Email Spoofing, DNS Spoofing, C2 Communications, Rogue Device, Brute Force, Phishing, Compromised Credentials, Account Takeover, Physical, Vulnerability, Reconnaissance, Domain Takeover, Lateral Movement, Network Exposure, Data Exposure, Credential Exposure, Suspicious User Activity, Suspicious Login, Suspicious Network Activity, Suspicious USB Device, Security Policy Violation, Security Compliance Violation Example:
"Endpoint Detection and Response (EDR)"
Was this page helpful?