Create Scan - BlinkOps Documentation

Create an on-demand scan for one or more hosts or host groups. Note: You must provide at least one of Hosts or Host Groups. The following permission is required to run this action:

On-demand scans (ODS): Write.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Basic Parameters

Parameter	Description
CPU Priority	The CPU utilization priority for the scan on the target hosts.
Description	The description of the scan.
Endpoint Notification	When selected, a notification is displayed on the endpoint while the scan runs.
File Paths	A comma-separated list of file paths to scan on the target hosts.
Host Groups	A comma-separated list of host group IDs to scan. Can be obtained via the `List Host Groups` action. Note: You must provide at least one of `Hosts` or `Host Groups`.
Hosts	A comma-separated list of host agent IDs (AIDs) to scan. Can be obtained via the `List Devices` action. Note: You must provide at least one of `Hosts` or `Host Groups`.
Quarantine	When selected, malicious files detected during the scan are quarantined.
Scan Exclusions	A comma-separated list of file path globs to exclude from the scan.

Advanced Parameters

Parameter	Description
Cloud ML Detection Level	The cloud-based machine learning detection sensitivity level for the scan.
Cloud ML Prevention Level	The cloud-based machine learning prevention level for the scan.
Initiated From	The name of the source that the scan was initiated from.
Max Duration	The maximum duration (in seconds) the scan is allowed to run before it is stopped.
Max File Size	The maximum size (in bytes) of files to be scanned.
Pause Duration	The amount of time (in seconds) to pause between scanning files.
Sensor ML Detection Level	The sensor-based machine learning detection sensitivity level for the scan.
Sensor ML Prevention Level	The sensor-based machine learning prevention level for the scan.

Example Output

{
	"meta": {
		"query_time": 0.0000000001,
		"powered_by": "ods-api",
		"writes": {
			"resources_affected": 1
		},
		"trace_id": "00000000-0000-0000-0000-000000000000"
	},
	"resources": [
		{
			"id": "00000000000000000000000000000000",
			"cid": "00000000000000000000000000000000",
			"profile_id": "00000000000000000000000000000000",
			"description": "",
			"file_paths": [],
			"scan_exclusions": [],
			"initiated_from": "",
			"cpu_priority": 0,
			"preemption_priority": 0,
			"metadata": [],
			"quarantine": false,
			"endpoint_notification": false,
			"pause_duration": 0,
			"max_duration": 0,
			"max_file_size": 0,
			"sensor_ml_level_detection": 0,
			"sensor_ml_level_prevention": 0,
			"cloud_ml_level_detection": 0,
			"cloud_ml_level_prevention": 0,
			"policy_setting": [],
			"scan_started_on": "",
			"scan_completed_on": "",
			"created_on": "0001-01-01T00:00:00Z",
			"created_by": "",
			"last_updated": "0001-01-01T00:00:00Z",
			"status": "pending",
			"hosts": [],
			"host_groups": [],
			"filecount": {
				"scanned": 0,
				"malicious": 0,
				"quarantined": 0,
				"skipped": 0
			}
		}
	],
	"errors": []
}

Workflow Library Example

Create Scan with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop