> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Find Malicious Domains

Find domains associated with malicious activity.

The following permissions are required to run this action:

* `Indicators (Falcon Indicator Graph)`: **Read**.

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/k978e55e/falcon-indicator-graph-apis#t41adbce).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter  | Description                                                                                                                                                                                                                                                         |
  | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filter     | Filter the results by a FQL query.<br /><br />For a complete list of filterable properties and syntax guidance, refer to the [CrowdStrike API documentation](https://falcon.us-2.crowdstrike.com/documentation/page/k978e55e/falcon-indicator-graph-apis#idf3b51b). |
  | Sort By    | The field to sort the results by.                                                                                                                                                                                                                                   |
  | Sort Order | The direction in which to sort the results.                                                                                                                                                                                                                         |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter | Description                                                  |
  | --------- | ------------------------------------------------------------ |
  | Limit     | The number of results to return. Valid range is `0` - `100`. |
</div>

## Example Output

```json theme={"dark"}
{
	"errors": [
		{
			"code": 0,
			"id": "string",
			"message": "string"
		}
	],
	"meta": {
		"pagination": {
			"limit": 0,
			"offset": 0,
			"total": 0
		},
		"powered_by": "string",
		"query_time": 0,
		"trace_id": "string",
		"writes": {
			"resources_affected": 0
		}
	},
	"resources": [
		{
			"Adversaries": [
				{
					"Name": "string"
				}
			],
			"AffectedCustomers": "string",
			"Certificates": [
				{
					"CertificateHash": "string",
					"CommonName": "string",
					"EmailAddress": "string",
					"IssuerCommonName": "string",
					"Organization": "string",
					"PublicKeyType": "string",
					"SignatureAlgorithm": "string",
					"Subject": "string"
				}
			],
			"Countries": [
				{
					"CountryCode": "string",
					"Name": "string"
				}
			],
			"DomainDetails": {
				"CreationDate": "string",
				"Domain": "string",
				"DomainUpdatedDate": "string",
				"EmailAddresses": [
					{
						"Address": "string",
						"ContactRole": "string",
						"Source": "string"
					}
				],
				"ExpirationDate": "string",
				"IPv4Addresses": [
					{
						"ASN": [
							0
						],
						"IPProperties": [
							"string"
						],
						"IPv4": "string",
						"ISP": "string"
					}
				],
				"IPv6Addresses": [
					{
						"ASN": [
							0
						],
						"IPProperties": [
							"string"
						],
						"IPv6": "string",
						"ISP": "string"
					}
				],
				"MXRecords": [
					{
						"Domain": "string",
						"Hostname": "string",
						"IPv4Addresses": [
							{
								"ASN": [
									0
								],
								"IPProperties": [
									"string"
								],
								"IPv4": "string",
								"ISP": "string"
							}
						],
						"IPv6Addresses": [
							{
								"ASN": [
									0
								],
								"IPProperties": [
									"string"
								],
								"IPv6": "string",
								"ISP": "string"
							}
						],
						"Priority": 0
					}
				],
				"NameServers": [
					{
						"Domain": "string",
						"Hostname": "string",
						"IPAddresses": [
							{
								"ASN": [
									0
								],
								"IPProperties": [
									"string"
								],
								"IPv4": "string",
								"ISP": "string"
							}
						]
					}
				],
				"Registrar": "string",
				"RegistrarStatus": [
					"string"
				],
				"WhoIS": {
					"AdminContact": {
						"City": "string",
						"Country": "string",
						"Fax": "string",
						"Name": "string",
						"Org": "string",
						"Phone": "string",
						"PostalCode": "string",
						"State": "string",
						"Street": "string"
					},
					"BillingContact": {
						"City": "string",
						"Country": "string",
						"Fax": "string",
						"Name": "string",
						"Org": "string",
						"Phone": "string",
						"PostalCode": "string",
						"State": "string",
						"Street": "string"
					},
					"RegistrantContact": {
						"City": "string",
						"Country": "string",
						"Fax": "string",
						"Name": "string",
						"Org": "string",
						"Phone": "string",
						"PostalCode": "string",
						"State": "string",
						"Street": "string"
					},
					"TechnicalContact": {
						"City": "string",
						"Country": "string",
						"Fax": "string",
						"Name": "string",
						"Org": "string",
						"Phone": "string",
						"PostalCode": "string",
						"State": "string",
						"Street": "string"
					}
				}
			},
			"FileDetails": {
				"FileProperties": [
					"string"
				],
				"FileSize": 0,
				"FileType": [
					"string"
				],
				"MD5": "string",
				"MagicFileType": "string",
				"SHA1": "string",
				"SHA256": "string"
			},
			"FirstSeen": "string",
			"ID": "string",
			"IPv4Details": {
				"ASN": [
					0
				],
				"IPProperties": [
					"string"
				],
				"IPv4": "string",
				"ISP": "string"
			},
			"IPv6Details": {
				"ASN": [
					0
				],
				"IPProperties": [
					"string"
				],
				"IPv6": "string",
				"ISP": "string"
			},
			"KillChain": [
				"string"
			],
			"LastSeen": "string",
			"LastUpdated": "string",
			"MaliciousConfidence": "string",
			"MaliciousConfidenceValidatedTime": "string",
			"PublishDate": "string",
			"Reports": [
				{
					"Title": "string"
				}
			],
			"Sectors": [
				{
					"Definition": "string",
					"Name": "string"
				}
			],
			"ThreatTypes": [
				"string"
			],
			"Threats": [
				{
					"FamilyName": "string"
				}
			],
			"Type": "string",
			"URLDetails": {
				"URL": "string",
				"URLProperties": [
					"string"
				]
			},
			"Vulnerabilities": [
				{
					"CPEEdition": "string",
					"CPELanguage": "string",
					"CPEOther": "string",
					"CPEPart": "string",
					"CPEProduct": "string",
					"CPESoftwareEdition": "string",
					"CPETargetHardware": "string",
					"CPETargetSoftware": "string",
					"CPEUpdate": "string",
					"CPEVendor": "string",
					"CPEVersion": "string",
					"CVE": "string",
					"Description": "string",
					"ExploitStatus": "string",
					"LastUpdated": "string",
					"PublishedDate": "string"
				}
			]
		}
	]
}
```

## Workflow Library Example

[Find Malicious Domains with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/find-malicious-domains-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/find-malicious-domains-with-crowdstrike-and-send-results-via-email/canvas" />
</div>