Lists all the assets that accessed the specified artifact in your enterprise within the specified time period.

External Documentation

To learn more, visit the Chronicle documentation.

​
Parameters

ParameterDescription
Alert Time AfterQuery by the time of the alert.
Alert Time BeforeQuery by the time of the alert.
ArtifactThe value of the artifact of the asset.
Artifact TypeThe type of the asset artifact.
Page SizeThe amount of alerts that will be returned every page.

​
Example Output

{
  assets: [
    {
      asset: {
        hostname: "rick"
      },
      firstSeenArtifactInfo: {
        artifactIndicator: {
          domainName: "www.altostrat.com"
        },
        seenTime: "2018-09-14T20:10:27.157476Z"
      },
      lastSeenArtifactInfo: {
        artifactIndicator: {
          domainName: "www.altostrat.com"
        },
        seenTime: "2019-10-24T22:04:04.327829Z"
      }
    },
    {
      asset: {
        hostname: "morty"
      },
      firstSeenArtifactInfo: {
        artifactIndicator: {
          domainName: "www.altostrat.com"
        },
        seenTime: "2019-06-17T21:22:44.812738Z"
      },
      lastSeenArtifactInfo: {
        artifactIndicator: {
          domainName: "www.altostrat.com"
        },
        seenTime: "2019-10-24T20:40:54.846676Z"
      }
    } ],
  uri: [ "https://sample.backstory.chronicle.security/domainResults?domain=
       altostrat.com&selectedList=DomainViewDistinctAssets&whoIsTimestamp=
       2020-01-08T21%3A09%3A13.000Z" ]
}

​
Workflow Library Example

List Assets with Chronicle and Send Results Via Email

Preview this Workflow on desktop