> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Find Hosts That Observed IOC

Find hosts that have observed a given custom Indicator of Compromise (IOC).
IOC is a piece of digital forensics (identification, investigation, and remediation of cyberattacks) that suggests that an endpoint or network may have been breached.
You can find the custom indicators in the [IOC Management page](https://falcon.us-2.crowdstrike.com/iocs/indicators).

The following permissions are required to run this action:

* `IOC Management`: **Read** and **Write**.
* `IOCs (Indicators of Compromise)`: **Read**.

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/ed1b4a95/detection-and-prevention-policy-apis#p3add076).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                              |
  | ---------------- | -------------------------------------------------------------------------------------------------------- |
  | Indicator Type   | The type of indicator used to search for hosts.                                                          |
  | Return All Pages | Automatically fetch all resources, page by page.                                                         |
  | Value            | The string representation of the indicator, can be obtained by using the `Get Indicator Details` action. |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter | Description                                                                                                               |
  | --------- | ------------------------------------------------------------------------------------------------------------------------- |
  | Limit     | Maximum number of hosts to return in the response.                                                                        |
  | Offset    | The offset at which to start record retrieval.<br /><br />Use with the `Limit` parameter to manage pagination of results. |
</div>

## Example Output

```json theme={"dark"}
{
  "meta": {
    "query_time": 7.444444,
    "pagination": {
      "offset": "",
      "limit": 100
    },
    "trace_id": ""0000000-00000-0000-0000-000000000000"",
    "entity": "/path/to/device{?ids*}"
  },
  "resources": [
    "000000111111222233333"
  ],
  "errors": []
}
```

## Workflow Library Example

[Find Hosts That Observed Ioc with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/find-hosts-that-observed-ioc-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/find-hosts-that-observed-ioc-with-crowdstrike-and-send-results-via-email/canvas" />
</div>