> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query Entity

Query entity.

## Basic Parameters

<div className="integrations-table">
  | Parameter                | Description                                                                          |
  | ------------------------ | ------------------------------------------------------------------------------------ |
  | Entity Filter Start Date | Limits the search results to any entities created within the given start date range. |
  | Filter                   | Filter entities based on the specified query.                                        |
  | Scopes                   | The scopes for the request.                                                          |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter              | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
  | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | Entity Filter End Date | Limits the search results to any entities created within the given end date range.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
  | Extended Filter        | Filter entities based on a specific SaaS attributes.<br /><br />**Note:** each filter object must have `saasAttrName` and `saasAttrOp` attributes.<br /><br />For example:<br /><br /><pre><code>\[<br />  \{<br />    "saasAttrName": "entityPayload.internetMessageId",<br />    "saasAttrOp": "is",<br />    "saasAttrValue": "value"<br />  },<br />  \{<br />    "saasAttrName": "entityPayload.internetMessageId",<br />    "saasAttrOp": "isEmpty",<br />  }<br />]</code></pre>For more information about the `Extended Filter` parameter, refer to [CheckPoint Harmony API documentation](https://sc1.checkpoint.com/documents/Harmony_Email_and_Collaboration_API_Reference/Topics-HEC-Avanan-API-Reference-Guide/Managing-Secured-Entities/Search-query.htm). |
  | Scroll ID              | The scroll identifier used for pagination. This value is obtained from a previous action result in the scrollId field and allows you to retrieve the next set of results in a sequence.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
</div>

## Example Output

```json theme={"dark"}
{
	"responseEnvelope": {
		"requestId": "<string>",
		"responseCode": 166,
		"responseText": "<string>",
		"additionalText": "<string>",
		"recordsNumber": 244,
		"scrollId": "<string>"
	},
	"responseData": [
		{
			"entityInfo": {
				"entityId": "<string>",
				"customerId": "<string>",
				"saas": "<string>",
				"saasEntityType": "<string>",
				"entityCreated": "<string>",
				"entityUpdated": "<string>",
				"entityActionState": null
			},
			"entityPayload": {
				"internetMessageId": "<string>",
				"subject": "<string>",
				"received": "<string>",
				"size": null,
				"emailLinks": [
					"<string>",
					"<string>"
				],
				"emailLinksDomains": [
					"<string>"
				],
				"attachmentCount": 1,
				"attachments": [],
				"mode": "<string>",
				"recipients": [
					"<string>"
				],
				"fromEmail": "<string>",
				"fromDomain": "<string>",
				"fromUser": {},
				"fromName": "<string>",
				"to": [
					"<string>"
				],
				"toUser": [],
				"cc": null,
				"ccUser": [],
				"bcc": null,
				"bccUser": [],
				"replyToEmail": "<string>",
				"replyToNickname": "<string>",
				"isRead": null,
				"isDeleted": false,
				"isIncoming": true,
				"isInternal": false,
				"isOutgoing": false,
				"isQuarantined": false,
				"isQuarantineNotification": false,
				"isQuarantineUserNotification": false,
				"isRestored": false,
				"isRestoreRequested": false,
				"isRestoreDeclined": false,
				"saasSpamVerdict": "<string>",
				"SpfResult": "<string>",
				"restoreRequestTime": null,
				"restoreCommentary": null,
				"senderServerIp": "<string>",
				"senderClientIp": null,
				"isUserExposed": true
			},
			"entitySecurityResult": {
				"combinedVerdict": {
					"ap": "<string>",
					"dlp": null,
					"clicktimeProtection": null,
					"shadowIt": "<string>",
					"av": null
				},
				"ap": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"reasons": [],
							"reasons_by_category": {
								"Email Headers": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Domain Impersonation": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Sender Reputation": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Links": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Email Text": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								]
							},
							"reasons_by_category_list": [
								"<string>",
								"<string>"
							]
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": null,
						"verdict": "<string>"
					}
				],
				"dlp": null,
				"clicktimeProtection": null,
				"shadowIt": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"from": "<string>",
							"to": "<string>",
							"subject": "<string>",
							"domain": "<string>"
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": "<string>",
						"verdict": "<string>"
					}
				],
				"av": null
			},
			"entityActions": [],
			"entityAvailableActions": []
		},
		{
			"entityInfo": {
				"entityId": "<string>",
				"customerId": "<string>",
				"saas": "<string>",
				"saasEntityType": "<string>",
				"entityCreated": "<string>",
				"entityUpdated": "<string>",
				"entityActionState": null
			},
			"entityPayload": {
				"internetMessageId": "<string>",
				"subject": "<string>",
				"received": "<string>",
				"size": null,
				"emailLinks": [
					"<string>",
					"<string>"
				],
				"emailLinksDomains": [
					"<string>",
					"<string>"
				],
				"attachmentCount": 1,
				"attachments": [
					{
						"name": "<string>",
						"mimetype": "<string>",
						"size": 1329,
						"MD5": "<string>"
					}
				],
				"mode": "<string>",
				"recipients": [
					"<string>"
				],
				"fromEmail": "<string>",
				"fromDomain": "<string>",
				"fromUser": {},
				"fromName": "<string>",
				"to": [
					"<string>"
				],
				"toUser": [],
				"cc": null,
				"ccUser": [],
				"bcc": null,
				"bccUser": [],
				"replyToEmail": "<string>",
				"replyToNickname": "<string>",
				"isRead": null,
				"isDeleted": false,
				"isIncoming": false,
				"isInternal": true,
				"isOutgoing": false,
				"isQuarantined": false,
				"isQuarantineNotification": false,
				"isQuarantineUserNotification": false,
				"isRestored": false,
				"isRestoreRequested": false,
				"isRestoreDeclined": false,
				"saasSpamVerdict": "<string>",
				"SpfResult": "<string>",
				"restoreRequestTime": null,
				"restoreCommentary": null,
				"senderServerIp": "<string>",
				"senderClientIp": null,
				"isUserExposed": true
			},
			"entitySecurityResult": {
				"combinedVerdict": {
					"ap": "<string>",
					"dlp": null,
					"clicktimeProtection": null,
					"shadowIt": null,
					"av": "<string>"
				},
				"ap": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"reasons": [],
							"reasons_by_category": {},
							"reasons_by_category_list": []
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": null,
						"verdict": "<string>"
					}
				],
				"dlp": null,
				"clicktimeProtection": null,
				"shadowIt": null,
				"av": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"scan_details": []
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": "<string>",
						"verdict": "<string>"
					}
				]
			},
			"entityActions": [],
			"entityAvailableActions": []
		}
	]
}
```

## Workflow Library Example

[Query Entity with Check Point Harmony and Send Results Via Email](https://library.blinkops.com/workflows/query-entity-with-check-point-harmony-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/query-entity-with-check-point-harmony-and-send-results-via-email/canvas" />
</div>