Actions
Overview
Blink supports the following CrowdStrike Actions:
- Check Analysis Progress
- Check MalQuery Operation Status
- Check Submission Quota
- CrowdStrike Cloud Query
- Configure Host Groups To File Integrity Policy
- Configure Rule Groups To File Integrity Policy
- Create Batch Session
- Create File Integrity Policy
- Create Indicator
- Create Prevention Policy
- Create Rule Within Rule Group
- Create Sensor Update Policy
- CrowdStrike Custom Action
- Delete Action
- Delete CSPM AWS Account
- Delete CSPM Azure Account
- Delete Custom Script
- Delete Device
- Delete Host Groups
- Delete Indicator
- Delete Report
- Delete Rule Groups
- Delete Rules
- Download Execution Report
- Find Hosts That Observed IOC
- Find Malicious Domains
- Find Malicious IPAddresses
- Get Adversaries
- Get Adversary Report
- Get Alert Details
- Get Analysis Report
- Get Analysis Report Summary
- Get Application
- Get Detection
- Get Devices By IDs
- Get Devices Count For IOC
- Get File Integrity Policies Details
- Get FileVantage Rule Group Details
- Get Indicator Details
- Get Installed Devices
- Get Prevention Policy
- Get Processes By IOC
- Get Remediations
- Get RTR Extracted File Contents
- Get RTR Sessions Details
- Get Scheduled Report
- Get Sensor Update Policy
- Get Vulnerabilities
- Isolate Endpoint
- Launch Scheduled Report
- Lift Endpoint Isolation
- List Adversary IDs
- List Alerts
- List Applications
- List Available Streams
- List Custom Scripts IDs
- List Detections
- List Devices
- List File Integrity Policies IDs
- List FileVantage Rule Group IDs
- List Host Groups
- List Incidents
- List Indicators
- List IOC Actions
- List IOC Platforms
- List IOC Severities
- List IOC Types
- List Parent Rule Groups
- List Prevention Policies
- List Report Executions
- List RTR Session Files
- List RTR Sessions
- List Scheduled Reports
- List Sensor Update Policies
- List Vulnerabilities
- MalQuery Exact Search
- MalQuery Fuzzy Search
- Next Gen SIEM Advanced Search
- Perform Host Action
- Perform Host Group Action
- Perform Incident Action
- Perform Prevention Policies Action
- Perform Sensor Update Policies Action
- Query Adversaries Intel Reports IDs
- Query Adversary Reports
- Query Submitted Samples
- Retrieve Process Details By ID
- Run Admin Command On A Single Host
- Run Command On A Single Host
- Run Command On Batch Session
- Schedule YARA Hunt
- Search Indicators
- Search Query By ID
- Search Vulnerabilities
- Submit File For Analysis
- Update Alerts
- Update File Integrity Policy
- Update Indicators
- Upload Custom Script
Missing an action? You can always create your own.