conclusions table.
Note: This trigger requires the AI SOC solution, which provides the
conclusions table.Note: Workflows based on this trigger will search for new events every minute.
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Trigger a workflow automatically when an AI SOC agent records a new conclusion in Blink case management.
conclusions table.
conclusions table.{
"agent_execution_id": "0f2b5f5f-4f0a-4c3a-9b0d-8b1a4b9a2c11",
"agent_id": "b7c1f2d3-4e5a-4b6c-8d7e-9f0a1b2c3d4e",
"auto_id": 42,
"case_ids": [
"bb2a5fcc-423b-4536-8b7a-63a547216579"
],
"conclusion_id": "CON-00042",
"created_at": 1755500123456,
"created_by": "test@blinkops.com",
"id": "3f9a1c62-2f4b-4a1e-9d2b-6c5f7e8a9b01",
"rating": null,
"rating_free_text": null,
"reasoning_details": "The alert was raised for an encoded PowerShell command spawned by WINWORD.EXE on WIN-SRV-01. The parent-child relationship, the encoded payload, and the outbound connection to a known-bad IP together indicate a successful phishing-driven execution.",
"reasoning_summary": "Encoded PowerShell spawned by Word, beaconing to a known-bad IP.",
"risk": 3,
"selected_labels": null,
"severity": 3,
"severity_change": "Maintained",
"title": "Malicious PowerShell execution confirmed on WIN-SRV-01",
"updated_at": 1755500123456,
"updated_by": "test@blinkops.com",
"verdict": "Malicious",
"verdict_confidence_score": 92
}
Was this page helpful?